CVE-2023-54035

What it actually does

Double decrement of chain reference counter in nf_tables set element addition error path causes reference underflow, enabling use-after-free on chain objects when nft_data_release() and element release both decrement.

Why it matters to the business

Systems relying on netfilter may experience kernel instability, crashes, or potential local privilege escalation, disrupting network filtering and increasing risk of compromise on affected Linux deployments.

How an attack unfolds

An attacker with local access crafts a netfilter set operation that triggers the error path during element addition, causing the chain reference counter to underflow. Subsequent operations then access freed chain memory, enabling use-after-free exploitation for arbitrary kernel read/write or code execution.

How to fix it

Upgrade the Linux kernel to a version containing commit b068314fd8ce751a7f906e55bb90f3551815f1a0 or later equivalent stable release. Rebuild and redeploy any affected container images that bundle the kernel or netfilter components.

How to confirm the fix worked

Confirm kernel version includes the referenced commit via uname or source inspection; test nf_tables set operations under error conditions to verify reference counts decrement exactly once; monitor for absence of use-after-free warnings in dmesg.

Typical attack path

1. Obtain local unprivileged access on target Linux system
2. Load or interact with nf_tables to create sets and chains
3. Trigger set element addition that enters the error path
4. Exploit resulting use-after-free on chain object for kernel memory corruption
5. Escalate to root or execute arbitrary kernel code

How to detect it

Review kernel logs for use-after-free warnings or slab corruption related to nf_tables chains; inspect audit logs for unusual nftables set element operations; correlate with process activity attempting netfilter configuration changes.

• nf_tables chain reference underflow
• double free in nft_data_release
• use-after-free in nf_tables

What your security team should do

• Prioritize kernel updates on all systems using nf_tables
• Restrict unprivileged local access where possible until patched
• Audit netfilter configurations for complex set and chain usage
• Enable kernel hardening features such as KASAN in test environments