New Linux NetFilter Kernel Flaw Let Attackers Gain Root Privileges

A recently found Linux NetFilter kernel vulnerability, identified as CVE-2023-32233, enables unprivileged local users to gain root-level privileges and full control over the affected system. However, the severity of the flaw has not yet been assessed.

The security issue with Netfilter nf_tables results from accepting invalid configuration updates, leading to subsystem state corruption through certain invalid batch requests.

New Linux NetFilter Kernel Flaw

Netfilter, an essential part of the Linux kernel, can be manipulated to create a use-after-free vulnerability, allowing unauthorized access and manipulation of kernel memory.

Security researchers developed and shared a proof-of-concept exploit to demonstrate the exploitation of CVE-2023-32233, a vulnerability affecting multiple Linux kernel versions, including the current stable release, v6.3.1, but requiring local access a Linux device for exploitation.

Engineer Pablo Neira Ayuso submitted a Linux kernel source code commit that introduces two functions to handle the lifecycle of anonymous sets in the Netfilter nf_tables subsystem, effectively preventing memory corruption and the potential privilege escalation to the root level by addressing the use-after-free issue.

Researchers Patryk Sondej and Piotr Krysiuk found a security flaw in Linux that enables unprivileged local users to gain root access, sharing their exploit privately with the Linux kernel team along with detailed techniques and source code to aid in developing a fix.

The analysts announced their intention to release the exploit and its detailed techniques, in accordance with the Linux-distros list policy, on May 15th, 2023, within the required 7-day timeframe.

Obtaining root-level access on Linux servers is a valuable tool for hackers, but CVE-2023-32233 requires attackers to first gain local access to the system before exploiting it, which is a mitigating factor.

While apart from this, in the mainline kernel git repository, the fix for the problem is available.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese…

5 hours ago

Massive Midnight Blizzard Phishing Attack Using Weaponized RDP Files

Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals in…

6 hours ago

Sophisticated Phishing Attack Targeting Ukraine Military Sectors

The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215 against…

6 hours ago

Chinese Hackers Attacking Microsoft Customers With Sophisticated Password Spray Attacks

Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors to…

6 hours ago

New Windows Zero-Day Vulnerability Let Attackers Steal Credentials From Victim’s Machine

A security researcher discovered a vulnerability in Windows theme files in the previous year, which…

6 hours ago

SYS01 InfoStealer Malware Attacking Meta Business Page To Steal Logins

The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy to…

6 hours ago