CVE-2023-1095: Linux Kernel Use-After-Free Vulnerability

CVE-2023-1095 Overview

CVE-2023-1095 is a NULL pointer dereference vulnerability in the Linux kernel's netfilter subsystem. The flaw resides in the nf_tables_updtable function within net/netfilter/nf_tables_api.c. When nf_tables_table_enable returns an error, the kernel calls nft_trans_destroy to free the transaction object. That function invokes list_del() on a transaction whose list head was never initialized and remains zeroed, triggering a NULL pointer dereference [CWE-476]. A local authenticated user with the ability to manipulate netfilter tables can crash the kernel and cause a denial of service condition on the affected host.

Critical Impact
Local users can trigger a kernel NULL pointer dereference in the netfilter nf_tables subsystem, leading to a denial of service through system crash.

Affected Products

Linux Kernel (upstream net/netfilter/nf_tables_api.c)
Red Hat Enterprise Linux 8.0
Red Hat Enterprise Linux 9.0

Discovery Timeline

2023-02-28 - CVE-2023-1095 published to the National Vulnerability Database
2025-03-18 - Last updated in NVD database

Technical Details for CVE-2023-1095

Vulnerability Analysis

The defect lives in the netfilter nf_tables transaction handling code path. When a user issues a table update through the netlink interface, nf_tables_updtable allocates a transaction object via nft_trans_alloc. If the subsequent call to nf_tables_table_enable fails, the cleanup path invokes nft_trans_destroy, which calls list_del() on the transaction's list field.

The allocated transaction object had not yet been linked into any list. Its list member contained zeroes from the initial allocation. The list_del() operation then attempts to dereference list->next->prev and list->prev->next, both of which resolve to NULL pointers. The result is a kernel oops and host crash.

The vulnerability is confined to local exploitation. An attacker requires the ability to issue netlink commands to the nf_tables subsystem, which on stock configurations requires CAP_NET_ADMIN within a user namespace.

Root Cause

The root cause is missing list head initialization on the transaction object. nft_trans_alloc returned the object without calling INIT_LIST_HEAD() on its embedded list field. Any cleanup path that called list_del() before the transaction was attached to a list would dereference NULL pointers.

Attack Vector

A local user invokes nf_tables_updtable with parameters that cause nf_tables_table_enable to fail. The kernel then proceeds to the error cleanup branch and calls nft_trans_destroy on the partially constructed transaction object. The NULL list_del() operation panics the kernel.

// Source: https://github.com/torvalds/linux/commit/580077855a40741cf511766129702d97ff02f4d9
// Patch in net/netfilter/nf_tables_api.c - initialize the transaction list head

 	if (trans == NULL)
 		return NULL;
 
+	INIT_LIST_HEAD(&trans->list);
 	trans->msg_type = msg_type;
 	trans->ctx	= *ctx;

The fix adds INIT_LIST_HEAD(&trans->list) immediately after allocation, ensuring that any subsequent list_del() operation on an unattached transaction is safe. Source: Linux kernel commit 580077855a40.

Detection Methods for CVE-2023-1095

Indicators of Compromise

Kernel oops or panic messages referencing nft_trans_destroy, list_del, or nf_tables_updtable in /var/log/messages, dmesg, or journalctl -k output.
Unexpected system crashes correlated with non-root processes invoking netlink NFNL_SUBSYS_NFTABLES operations.
Crash dumps with backtraces in __list_del_entry_valid originating from net/netfilter/nf_tables_api.c.

Detection Strategies

Audit kernel logs for general protection fault or BUG: unable to handle kernel NULL pointer dereference events tied to netfilter call sites.
Monitor auditd for unprivileged processes using nft or raw netlink sockets against the nf_tables subsystem.
Correlate user namespace creation events with subsequent netfilter table update syscalls to identify exploitation attempts from unprivileged contexts.

Monitoring Recommendations

Forward kernel ring buffer and auditd events to a centralized log platform and alert on kernel panics referencing netfilter symbols.
Track usage of CAP_NET_ADMIN within user namespaces by non-administrative accounts.
Inventory hosts by kernel version to identify systems still running vulnerable builds.

How to Mitigate CVE-2023-1095

Immediate Actions Required

Apply vendor kernel updates that include upstream commit 580077855a40741cf511766129702d97ff02f4d9 and reboot affected hosts.
For Red Hat Enterprise Linux 8 and 9, install the kernel errata referenced in Red Hat Bug 2173973.
Restrict the ability of unprivileged users to create user namespaces where they would gain CAP_NET_ADMIN over a private network namespace.

Patch Information

The upstream fix is available in the Linux kernel mainline via commit 580077855a40741cf511766129702d97ff02f4d9, which adds INIT_LIST_HEAD(&trans->list) to nft_trans_alloc. Distribution-specific backports are tracked in the Red Hat Bugzilla entry #2173973. Administrators should validate that their running kernel image includes the patched nf_tables_api.c change before declaring remediation complete.

Workarounds

Set kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or user.max_user_namespaces=0 (RHEL) to prevent unprivileged user namespace creation where it is not required.
Restrict loading of the nf_tables kernel module on hosts that do not require it by blacklisting it through /etc/modprobe.d/.
Limit access to the nft binary and netlink sockets through SELinux or AppArmor policies tied to administrative users only.

bash

# Configuration example: disable unprivileged user namespaces on RHEL 8/9
echo 'user.max_user_namespaces = 0' | sudo tee /etc/sysctl.d/99-disable-userns.conf
sudo sysctl --system

# Verify the running kernel includes the patched commit
uname -r
rpm -q --changelog kernel | grep -i "CVE-2023-1095"