CVE-2023-4194: Linux Kernel Auth Bypass Vulnerability

CVE-2023-4194 Overview

CVE-2023-4194 is a type confusion flaw [CWE-843] in the Linux kernel's TUN/TAP virtual network device functionality. The vulnerability stems from an incomplete fix for CVE-2023-1076. Upstream commits a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid") and 66b2c338adce ("tap: tap_open(): correctly initialize socket uid") passed inode->i_uid to sock_init_data_uid() as the last parameter, which is not the accurate value. A local authenticated user can exploit this to bypass network filters and gain unauthorized access to resources tied to socket ownership.

Critical Impact
A local user can bypass network filters tied to socket UID checks, enabling unauthorized access to network resources on affected Linux systems.

Affected Products

Linux Kernel (including 6.5-rc1 through 6.5-rc4)
Red Hat Enterprise Linux 8.0 and 9.0
Fedora 37 and 38
Debian Linux 10, 11, and 12

Discovery Timeline

2023-08-07 - CVE-2023-4194 published to NVD
2026-03-24 - Last updated in NVD database

Technical Details for CVE-2023-4194

Vulnerability Analysis

The TUN/TAP driver provides packet reception and transmission for user-space programs through virtual point-to-point or Ethernet devices. Sockets associated with these devices store a UID used by network filters and firewall hooks for owner-based decisions. The fix for the prior CVE-2023-1076 attempted to correct the socket UID initialization, but used the wrong source value. As a result, the socket's owner UID does not reflect the actual creating user in expected scenarios.

When sock_init_data_uid() receives inode->i_uid instead of the appropriate effective UID, the socket inherits the UID of the underlying device node, typically owned by root. Network filtering rules that rely on socket ownership therefore evaluate against an incorrect identity, allowing a local user to bypass UID-based filter policies.

Root Cause

The root cause is a type-confusion-style misuse [CWE-843] in tun_chr_open() and tap_open(). The functions pass inode->i_uid, the device file's owner UID, to sock_init_data_uid() instead of the opening process's effective UID. Two resources that should differ in identity are treated as equivalent, producing incorrect socket ownership metadata.

Attack Vector

Exploitation requires local access and the ability to open /dev/net/tun or related TAP device nodes. An authenticated user opens the TUN/TAP device, creating a socket whose UID does not reflect their identity. Subsequent traffic generated through the device evades iptables, nftables, or cgroup owner-match rules predicated on socket UID. The flaw does not enable code execution, but it undermines integrity of network access controls.

The vulnerability is described in prose because no public proof-of-concept exploit is available. For technical specifics, see the Red Hat CVE-2023-4194 Details and the Kernel Mailing List Update 1.

Detection Methods for CVE-2023-4194

Indicators of Compromise

Unexpected TUN/TAP device creation by non-administrative users on multi-tenant Linux hosts
Outbound network traffic from local users that bypasses configured owner-match firewall rules
Sockets bound to TUN/TAP interfaces reporting a UID inconsistent with the opening process

Detection Strategies

Audit running kernel versions against vendor advisories such as Red Hat Security Advisory RHSA-2023:6583 and Debian Security Advisory DSA-5480.
Monitor open() syscalls on /dev/net/tun and /dev/tap* using auditd rules to identify unusual access by unprivileged accounts.
Inspect ss -tnpe output for socket UID values that do not match the process owner of associated TUN/TAP user-space programs.

Monitoring Recommendations

Enable kernel audit subsystem logging for CAP_NET_ADMIN operations and TUN/TAP ioctl calls such as TUNSETIFF.
Centralize Linux audit and syslog data for correlation across hosts to identify abnormal patterns in TUN/TAP usage.
Track firewall counter deltas on owner-match rules to detect traffic that should have been filtered but was not.

How to Mitigate CVE-2023-4194

Immediate Actions Required

Inventory all Linux hosts running the affected kernel versions, including Red Hat Enterprise Linux 8 and 9, Fedora 37 and 38, and Debian 10 through 12.
Apply the vendor-supplied kernel updates referenced in RHSA-2023:6583, DSA-5480, and DSA-5492.
Restrict access to /dev/net/tun to trusted users and groups until patching is complete.

Patch Information

Distribution vendors have published fixed kernels. Red Hat addresses the issue in RHSA-2023:6583. Debian provides patched kernels in DSA-5480 and DSA-5492, with long-term support coverage in the Debian LTS Security Announcement. Fedora updates are tracked in Fedora Package Announcement 1 and Fedora Package Announcement 2. NetApp users should reference NTAP-20231027-0002.

Workarounds

Remove or restrict permissions on /dev/net/tun so only privileged users can open TUN/TAP devices.
Disable the tun kernel module on systems that do not require virtual networking by blacklisting it in /etc/modprobe.d/.
Replace owner-UID-based firewall rules with rules anchored to network namespaces or interfaces while patches are deployed.

bash

# Configuration example: restrict TUN/TAP access pending patch deployment
chmod 0600 /dev/net/tun
chown root:root /dev/net/tun

# Blacklist the tun module on systems that do not require it
echo 'blacklist tun' | sudo tee /etc/modprobe.d/disable-tun.conf
sudo update-initramfs -u