CVE-2023-6622

What it actually does

Null pointer dereference in nft_dynset_init() within the nf_tables subsystem allows a local process holding CAP_NET_ADMIN to cause a kernel crash.

Why it matters to the business

Local users on affected Linux systems can trigger repeated denial-of-service conditions, leading to unplanned reboots, service outages, and operational disruption on servers and endpoints; prevalence across the Linux ecosystem increases exposure surface for organizations relying on Red Hat or upstream kernels.

How an attack unfolds

An attacker with CAP_NET_ADMIN creates a malicious nftables dynamic set via the netlink interface; nft_dynset_init() dereferences a null pointer during initialization, resulting in a kernel panic. Threat actors targeting Linux kernel memory issues may chain or adapt similar local privilege contexts for DoS.

How to fix it

Apply the upstream kernel patch for nft_dynset_init() or upgrade to a fixed kernel version from your distribution; disable untrusted local users from obtaining CAP_NET_ADMIN where feasible via SELinux, AppArmor, or capability bounding.

How to confirm the fix worked

Confirm kernel version is newer than the vulnerable commit; attempt to load a test nftables dynamic set as a non-privileged or capability-limited user and verify absence of kernel oops or panic in dmesg.

Typical attack path

1. Obtain local shell access on target Linux host
2. Acquire or escalate to CAP_NET_ADMIN capability
3. Craft and submit a netlink message to create an nft_dynset with invalid parameters
4. Trigger nft_dynset_init() to induce null dereference and kernel crash

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for null pointer dereference oops in nft_dynset.c or nf_tables around the time of unexpected reboots; correlate with netlink or nftables configuration changes by privileged processes.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-tenant Linux systems within the next patching cycle
• Audit which service accounts or containers hold CAP_NET_ADMIN and reduce where unnecessary
• Enable kernel panic logging and monitoring to detect repeated crashes indicative of exploitation attempts