CVE-2023-7192

What it actually does

Memory leak in ctnetlink_create_conntrack within net/netfilter/nf_conntrack_netlink.c allows repeated allocation without proper release, leading to refcount overflow and eventual denial of service when triggered by a process holding CAP_NET_ADMIN.

Why it matters to the business

Local privileged users on affected Linux systems can trigger crashes or resource exhaustion that disrupts network connectivity and system stability; the issue affects a wide range of distributions using the vulnerable kernel versions but carries low external exploit risk given the required privileges and stable low EPSS.

How an attack unfolds

An attacker with local access and CAP_NET_ADMIN first obtains a shell or process context on the target, then repeatedly invokes netlink operations that call ctnetlink_create_conntrack; each invocation leaks memory and increments a reference count without decrement, eventually overflowing the counter and causing the kernel to terminate the conntrack subsystem or panic the system.

How to fix it

Upgrade the Linux kernel to a version containing commit 457391b0380335d5e9a5babdec90ac53928b23b4 or later; rebuild and reboot with the patched kernel; where immediate patching is not feasible, restrict CAP_NET_ADMIN to only trusted processes and monitor for anomalous netlink activity.

How to confirm the fix worked

Verify the running kernel contains commit 457391b0380335d5e9a5babdec90ac53928b23b4 by checking /proc/version or kernel build logs; attempt to reproduce the leak with a non-privileged test binary and confirm no refcount growth occurs after the update.

Typical attack path

1. Obtain local shell or process with CAP_NET_ADMIN capability on a vulnerable Linux kernel
2. Craft and send repeated netlink messages targeting conntrack creation via nf_conntrack_netlink
3. Trigger the memory leak path in ctnetlink_create_conntrack multiple times
4. Accumulate reference count until overflow occurs
5. Observe kernel-induced denial of service affecting network functions

How to detect it

Review system and audit logs for processes exercising netlink conntrack operations under high-privilege contexts; correlate with memory usage spikes or conntrack table anomalies; examine kernel oops/panic logs for refcount-related warnings after the publication date.

What your security team should do

• Prioritize kernel upgrades containing commit 457391b0380335d5e9a5babdec90ac53928b23b4 across all affected systems
• Audit which services and users hold CAP_NET_ADMIN and reduce the scope where possible
• Add kernel version checks to vulnerability scanning and asset inventory pipelines
• Monitor EPSS and threat intelligence feeds for any future rise in exploit maturity