CVE-2023-31248
📋 TL;DR
This CVE-2023-31248 is a use-after-free vulnerability in the Linux kernel's nftables subsystem that allows local attackers to escalate privileges. The flaw occurs when nft_chain_lookup_byid() fails to verify chain activity status and CAP_NET_ADMIN capability checks across user/network namespaces. Any Linux system with nftables enabled and unpatched kernel versions is affected.
💻 Affected Systems
- Linux Kernel
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
Ubuntu Linux by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Local unprivileged user gains full root privileges, compromising the entire system and potentially accessing all data and resources.
Likely Case
Local user with some access escalates to root, installs persistence mechanisms, accesses sensitive data, and moves laterally.
If Mitigated
Attackers without local access cannot exploit; systems with strict user controls limit damage even if exploited.
🎯 Exploit Status
Exploit requires local access and knowledge of kernel exploitation; public proof-of-concept exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Varies by distribution; check specific vendor advisories for patched kernel versions
Vendor Advisory: Multiple - see references in CVE description for distribution-specific advisories
Restart Required: Yes
Instructions:
1. Check your Linux distribution's security advisory. 2. Update kernel package using package manager (apt/yum/dnf/zypper). 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable nftables module
linuxUnload nftables kernel module to prevent exploitation (may break firewall functionality)
sudo rmmod nf_tables
sudo rmmod nft_chain_nat
sudo rmmod nft_ct
sudo rmmod nft_counter
sudo rmmod nft_limit
sudo rmmod nft_log
sudo rmmod nft_masq
sudo rmmod nft_nat
sudo rmmod nft_redir
sudo rmmod nft_reject
sudo rmmod nft_set_hash
sudo rmmod nft_set_rbtree
Blacklist nftables modules
linuxPrevent nftables modules from loading at boot
echo 'blacklist nf_tables' | sudo tee /etc/modprobe.d/blacklist-nftables.conf
echo 'blacklist nft_chain_nat' | sudo tee -a /etc/modprobe.d/blacklist-nftables.conf
sudo update-initramfs -u
🧯 If You Can't Patch
- Restrict local user access through strict authentication and least privilege principles
- Implement kernel module signing and disable module auto-loading where possible
🔍 How to Verify
Check if Vulnerable:
Check kernel version against your distribution's security advisory; also check if nftables is loaded: lsmod | grep nf_tablesCheck Version:
uname -rVerify Fix Applied:
Verify kernel version after update matches patched version from vendor advisory; ensure system rebooted📡 Detection & Monitoring
Log Indicators:
- Kernel oops messages related to nftables
- Unexpected privilege escalation events in audit logs
- Failed module loading attempts for nftables
Network Indicators:
- None - this is local exploitation only
SIEM Query:
Example: (event_type="privilege_escalation" OR event_type="kernel_panic") AND process_name CONTAINS "nft"🔗 References
- http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html
- http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html
- http://www.openwall.com/lists/oss-security/2023/07/05/2
- https://lists.debian.org/debian-lts-announce/2023/08/msg00001.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGZC5XOANA75OJ4XARBBXYSLDKUIJI5E/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPHI46ROSSLVAV4R5LJWJYU747JGOS6D/
- https://lore.kernel.org/netfilter-devel/20230705121627.GC19489@breakpoint.cc/T/
- https://security.netapp.com/advisory/ntap-20240201-0001/
- https://www.debian.org/security/2023/dsa-5453
- https://www.openwall.com/lists/oss-security/2023/07/05/2
- http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html
- http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html
- http://www.openwall.com/lists/oss-security/2023/07/05/2
- https://lists.debian.org/debian-lts-announce/2023/08/msg00001.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGZC5XOANA75OJ4XARBBXYSLDKUIJI5E/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPHI46ROSSLVAV4R5LJWJYU747JGOS6D/
- https://lore.kernel.org/netfilter-devel/20230705121627.GC19489@breakpoint.cc/T/
- https://security.netapp.com/advisory/ntap-20240201-0001/
- https://www.debian.org/security/2023/dsa-5453
- https://www.openwall.com/lists/oss-security/2023/07/05/2
