CVE-2023-6040

What it actually does

Out-of-bounds memory access in the nf_tables_newtable function when an invalid network protocol family value is supplied during netfilter table creation.

Why it matters to the business

Local attackers on affected Linux systems can corrupt kernel memory, enabling privilege escalation, data theft, or denial of service that disrupts operations and requires urgent patching across server fleets.

How an attack unfolds

An attacker with local access crafts a malicious netfilter table request containing an unsupported family value; the missing validation in nf_tables_newtable leads to out-of-bounds read or write, which is then leveraged for kernel memory corruption and code execution.

How to fix it

Upgrade the Linux kernel to version 5.10.221-1 or newer on all Debian 11 systems; apply the patch that rejects unsupported nf_tables families in nf_tables_newtable.

How to confirm the fix worked

Verify installed kernel version is at least 5.10.221-1, confirm the nf_tables_newtable function contains the family validation check via source inspection or binary diff, and test table creation with invalid families to ensure rejection.

Typical attack path

1. Obtain local shell or process execution on target system
2. Load or interact with nf_tables to issue a newtable command with invalid pf value
3. Trigger out-of-bounds memory access
4. Escalate privileges or achieve arbitrary kernel code execution

How to detect it

Review kernel audit logs and dmesg for nf_tables table creation attempts with invalid family values, monitor for unusual netfilter configuration changes via auditd or eBPF, and inspect for post-exploitation artifacts such as unexpected kernel memory mappings.

What your security team should do

• Prioritize kernel upgrades on all internet-facing and multi-tenant Linux hosts within the CISA remediation window if applicable
• Restrict unprivileged local access where possible until patches are deployed
• Enable kernel hardening features such as lockdown mode and audit logging for netfilter operations
• Scan for and remove any custom netfilter scripts that may inadvertently trigger the flaw