CVE-2023-42753: Linux Kernel Privilege Escalation Flaw

CVE-2023-42753 Overview

CVE-2023-42753 is an array indexing flaw in the netfilter subsystem of the Linux kernel. A missing macro causes a miscalculation of the h->nets array offset within the ipset code path. The defect gives a local attacker a primitive to increment or decrement memory out-of-bounds. Successful exploitation can crash the kernel or lead to local privilege escalation. The issue affects upstream Linux kernel builds shipped by major distributions, including Red Hat Enterprise Linux 7, 8, and 9, and Debian 10. The vulnerability is tracked under [CWE-787] (Out-of-Bounds Write).

Critical Impact
A local, low-privileged user can corrupt kernel memory through an out-of-bounds write primitive, enabling denial of service or full root privilege escalation.

Affected Products

Linux Linux Kernel (multiple versions)
Red Hat Enterprise Linux 7, 8, and 9
Debian Linux 10

Discovery Timeline

2023-09-22 - Vulnerability disclosed via the OpenWall oss-security mailing list
2023-09-25 - CVE-2023-42753 published to NVD
2023-10 - Debian LTS publishes initial advisory
2023-11 through 2024-02 - Red Hat publishes multiple RHSA errata addressing the flaw
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-42753

Vulnerability Analysis

The vulnerability resides in the ipset component of the Linux netfilter subsystem. ipset provides hash-based IP, network, and port set structures used by iptables and nftables for efficient firewall matching. The hash:net family of sets tracks network entries across multiple CIDR prefix lengths using the h->nets array, where each element records reference counts for a given prefix length.

A missing macro in the index computation causes the offset into h->nets to be miscalculated. When the kernel updates the per-prefix counters during set element add or delete operations, the corrupted index points outside the bounds of the array. This results in an attacker-influenced increment or decrement of arbitrary adjacent kernel memory.

Root Cause

The defect is an integer-handling error in the macro layer that translates a CIDR prefix length into an array index. Without the corrective macro, the index arithmetic does not align with the actual layout of h->nets, producing an off-by-N condition that crosses the allocated boundary. The result is a classic out-of-bounds write primitive ([CWE-787]) in privileged kernel context.

Attack Vector

Exploitation requires local access and the ability to create or modify ipset entries, which typically needs CAP_NET_ADMIN. On systems where unprivileged user namespaces are enabled, a local user can acquire CAP_NET_ADMIN inside a new namespace and reach the vulnerable code path without prior root privileges. By repeatedly adding and removing hash:net entries with crafted prefix lengths, an attacker drives the miscalculated index to a chosen offset and increments or decrements neighboring kernel objects. With careful heap shaping, this primitive can be converted into kernel control-flow hijack or credential structure modification, yielding root privileges. No public exploit code is currently published for this CVE.

No verified proof-of-concept code is available for CVE-2023-42753. Refer to the Red Hat CVE advisory and Red Hat Bugzilla Report #2239843 for vendor-side technical analysis.

Detection Methods for CVE-2023-42753

Indicators of Compromise

Unexpected kernel oops or panic messages in dmesg referencing ip_set, ip_set_hash_net, or netfilter call stacks.
KASAN out-of-bounds write reports against the hash:net ipset structures on kernels built with KASAN enabled.
Unprivileged processes invoking unshare(CLONE_NEWUSER | CLONE_NEWNET) followed by ipset netlink operations.

Detection Strategies

Monitor auditd for netlink socket creation with NETLINK_NETFILTER from non-administrative users, particularly inside user namespaces.
Alert on userland binaries spawning shells with elevated UID transitions immediately after netfilter or ipset syscalls.
Correlate kernel ring-buffer warnings with subsequent privilege-changing events such as setuid(0) from previously unprivileged PIDs.

Monitoring Recommendations

Enable kernel auditing for the unshare, setns, and clone syscalls when CLONE_NEWUSER is requested.
Track package state of kernel, kernel-core, and linux-image to confirm patched builds are running after reboot.
Forward kernel logs and EDR telemetry to a centralized data lake to surface kernel panics tied to netfilter components across the fleet.

How to Mitigate CVE-2023-42753

Immediate Actions Required

Apply the kernel update from your distribution and reboot, or apply a live patch where supported, on all systems running affected kernels.
Inventory hosts running RHEL 7, 8, 9, and Debian 10, and prioritize multi-tenant or container hosts where local users are present.
Disable unprivileged user namespaces where not required by setting kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or user.max_user_namespaces=0.

Patch Information

Red Hat addressed CVE-2023-42753 across multiple errata, including RHSA-2023:7370, RHSA-2023:7379, RHSA-2023:7411, RHSA-2023:7539, and follow-up advisories through RHSA-2024:0999. Debian published fixes in the Debian LTS Announcement October 2023 and Debian LTS Announcement January 2024. Canonical shipped a kernel live patch in Kernel Live Patch Security Notice LSN-0099-1. Confirm the running kernel matches the patched version after reboot.

Workarounds

Restrict CAP_NET_ADMIN and disable unprivileged user namespaces to prevent local users from reaching the vulnerable ipset code path.
Where ipset functionality is not required, blacklist the ip_set and dependent modules to remove the attack surface.
Enforce SELinux or AppArmor profiles that deny netlink socket creation to untrusted workloads and container users.

bash

# Configuration example: reduce exposure on affected hosts
# Disable unprivileged user namespaces (Debian/Ubuntu)
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-cve-2023-42753.conf

# Disable all user namespaces (RHEL/Fedora)
sysctl -w user.max_user_namespaces=0
echo 'user.max_user_namespaces=0' >> /etc/sysctl.d/99-cve-2023-42753.conf

# Blacklist ipset modules if unused
cat <<EOF > /etc/modprobe.d/blacklist-ipset.conf
blacklist ip_set
blacklist ip_set_hash_net
blacklist ip_set_hash_netnet
EOF

# Verify the running kernel includes the fix
uname -r
rpm -q kernel || dpkg -l | grep linux-image