CVE-2023-54200

What it actually does

Use-after-free in nf_hook_entry_head triggered during netns pre_exit when veth peer devices cause device memory to be freed before nft_netdev_unregister_hooks runs, due to ignored netdev unregister events on netns removal.

Why it matters to the business

Kernel crashes or potential local privilege escalation on systems using nftables with virtual network devices, leading to downtime or compromise of network infrastructure.

How an attack unfolds

An attacker creates veth pairs across network namespaces and triggers namespace teardown; the race between veth release callbacks and nftables hook cleanup allows a freed slab object to be dereferenced in nf_hook_entry_head during kworker netns cleanup.

How to fix it

Upgrade Linux kernel to a version containing commit 8d56f00c61f67b450fbbdcb874855e60ad92c560 or later; apply the revert of the netns removal event skip logic in nf_tables.

How to confirm the fix worked

Verify kernel source contains the fix commit; test namespace teardown with veth pairs under nftables rules and confirm absence of KASAN reports in nf_hook_entry_head.

Typical attack path

1. Create veth pair spanning two network namespaces
2. Install nftables hooks on netdev in one namespace
3. Trigger removal of the first namespace to queue peer device teardown
4. Force peer namespace cleanup while device memory is already released
5. Trigger KASAN-detected slab-use-after-free in nf_hook_entry_head

How to detect it

Inspect kernel logs for KASAN slab-use-after-free reports mentioning nf_hook_entry_head, __nf_unregister_net_hook, nft_netdev_unregister_hooks, or nf_tables_pre_exit_net during netns cleanup_net workqueue activity.

What your security team should do

• Prioritize kernel updates on all systems running nftables with virtual interfaces
• Monitor for netns cleanup workloads involving veth devices
• Apply the patch immediately on exposed multi-namespace environments even if EPSS remains low