CVE-2023-3390

CVE-2023-3390 is a use-after-free vulnerability in the Linux kernel's netfilter subsystem, specifically in net/netfilter/nf_tables_api.c, affecting Linux and NetApp products. This flaw stems from mishandled error handling with NFT_MSG_NEWRULE, leading to a dangling pointer that can be exploited within the same transaction. With a CVSS score of 7.8 (HIGH), a local attacker with user access can leverage this vulnerability to achieve privilege escalation, resulting in high impact to confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Despite this, the vulnerability has garnered some community discussion and media coverage.