CVE-2023-6111

What it actually does

Use-after-free in nft_trans_gc_catchall allows repeated freeing of catchall set elements in nf_tables when sync=true, enabling local attackers to corrupt kernel memory and escalate privileges.

Why it matters to the business

Local users on affected Linux systems can gain full root access, leading to complete system compromise, data theft, or persistence without external network access.

How an attack unfolds

An attacker with local user access crafts malicious nftables rules that trigger repeated freeing of a catchall set element during garbage collection, then reuses the dangling pointer to overwrite kernel structures and execute arbitrary code with elevated privileges.

How to fix it

Upgrade the Linux kernel to a version containing commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630 or later; rebuild and reboot all affected systems.

How to confirm the fix worked

Confirm the running kernel includes commit 93995bf4af2c5a99e2a87f0cd5ce547d31eb7630 via git log or version string; test nftables catchall operations under load to verify absence of use-after-free.

Typical attack path

1. Obtain local shell access as an unprivileged user
2. Load or manipulate nftables sets to trigger the faulty gc path with sync=true
3. Trigger repeated free operations on the catchall element
4. Reclaim the freed memory with attacker-controlled data
5. Escalate to root via corrupted kernel objects

How to detect it

Review kernel audit logs and dmesg for repeated nftables garbage collection events or suspicious use-after-free warnings; correlate with local user activity around nftables rule changes.

What your security team should do

• Prioritize kernel updates on all multi-user or exposed Linux hosts
• Restrict unprivileged nftables access via capabilities or user namespaces where possible
• Monitor for unusual local privilege escalation attempts in audit logs
• Apply updates before the next scheduled maintenance window given the stable low EPSS