CVE-2023-32269 Overview
CVE-2023-32269 is a use-after-free vulnerability in the Linux kernel's NetROM protocol implementation, located in net/netrom/af_netrom.c. The flaw exists because the accept system call is permitted on an already successfully connected AF_NETROM socket, leading to memory corruption [CWE-416]. The issue affects Linux kernel versions before 6.1.11.
Exploitation requires either NetROM routing to be configured on the target system or the attacker to possess the CAP_NET_ADMIN capability. This precondition limits the realistic attack surface to local privileged contexts and environments using legacy amateur radio networking.
Critical Impact
Local attackers with CAP_NET_ADMIN or access to a system with NetROM routing configured can trigger memory corruption that may lead to privilege escalation or kernel-level code execution.
Affected Products
- Linux kernel versions prior to 6.1.11
- Distributions shipping vulnerable upstream kernels with NetROM support enabled
- Systems with the netrom kernel module loaded and routing configured
Discovery Timeline
- 2023-05-05 - CVE-2023-32269 published to NVD
- 2025-05-05 - Last updated in NVD database
Technical Details for CVE-2023-32269
Vulnerability Analysis
The vulnerability resides in the NetROM socket implementation in net/netrom/af_netrom.c. NetROM is a legacy networking protocol originally designed for packet radio. The Linux implementation exposes an AF_NETROM socket family that follows the standard BSD socket state machine.
The defect allows accept() to be invoked on a socket that has already completed a connect() operation. Calling accept() on a connected socket triggers code paths that operate on socket buffers and connection state that have already transitioned out of the listening state. This results in dereferencing freed memory structures within kernel context.
Successful exploitation yields high confidentiality, integrity, and availability impact in the local context, with kernel memory corruption providing a path toward privilege escalation.
Root Cause
The root cause is missing state validation in the NetROM accept handler. The kernel does not reject accept() calls on sockets in the connected state, allowing the operation to proceed against connection objects whose lifecycle has already advanced. The resulting use-after-free condition arises because freed socket buffers and control structures remain reachable through the accept code path.
Attack Vector
The attack requires local access and either CAP_NET_ADMIN capability or a system already configured with NetROM routing. An attacker creates an AF_NETROM socket, calls connect() to establish a connection, then invokes accept() on the same socket. The accept handler operates on freed memory, producing the corruption primitive.
No code execution example is published in the available references. The upstream fix in commit 6117929 adds the missing state check to reject accept() on connected sockets, as documented in the Linux Kernel ChangeLog 6.1.11.
Detection Methods for CVE-2023-32269
Indicators of Compromise
- Kernel oops or panic messages referencing nr_accept, netrom, or af_netrom.c in dmesg output
- KASAN reports indicating use-after-free in NetROM socket handlers on instrumented kernels
- Unexpected loading of the netrom kernel module on systems that do not require amateur radio protocols
Detection Strategies
- Inventory running kernel versions and flag any host running a kernel prior to 6.1.11 or an unpatched distribution backport
- Audit processes invoking socket(AF_NETROM, ...) through Linux auditd rules or eBPF instrumentation
- Monitor capability grants of CAP_NET_ADMIN to non-administrative processes and containers
Monitoring Recommendations
- Enable kernel crash collection (kdump) and forward crash artifacts to a central analysis pipeline
- Alert on creation of AF_NETROM sockets in production workloads where the protocol is not in use
- Track changes to NetROM routing configuration through configuration management drift detection
How to Mitigate CVE-2023-32269
Immediate Actions Required
- Upgrade the Linux kernel to version 6.1.11 or later, or apply the vendor backport for your distribution
- Blacklist the netrom kernel module on systems that do not require amateur radio networking
- Restrict CAP_NET_ADMIN to administrative accounts and harden container capability sets
Patch Information
The fix is upstream commit 611792920925fb088ddccbe2783c7f92fdfb6b64, included in Linux kernel 6.1.11. The patch adds validation that rejects accept() calls on already-connected AF_NETROM sockets. Distribution maintainers have backported the fix to supported stable branches; consult vendor advisories for the relevant package version.
Workarounds
- Prevent loading of the NetROM module by adding install netrom /bin/true to /etc/modprobe.d/blacklist-netrom.conf
- Remove or disable NetROM routing configuration where the protocol is not operationally required
- Drop CAP_NET_ADMIN from container and service capability bounding sets using seccomp or systemd CapabilityBoundingSet=
# Configuration example
# Blacklist the netrom module to eliminate the attack surface
echo "install netrom /bin/true" | sudo tee /etc/modprobe.d/blacklist-netrom.conf
sudo rmmod netrom 2>/dev/null || true
# Verify the module is not loaded
lsmod | grep netrom
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
