CVE-2023-35001: (Pwn2Own) Linux Kernel nftables Incorrect Pointer Scaling Local Privilege Escalation Vulnerability
Last updated 18 March 2026
Other sources
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a nftables nftbyteordereval out-of-bounds read/write. By sending a specially crafted request, an aattacker could exploit this vulnerability to escalate privileges.
— IBM
Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nftbyteorder poorly handled vm register contents when CAPNETADMIN is in any user or network namespace
— Launchpad
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the processing of nft chains. The issue results from incorrect pointer scaling, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.251-5Fixed in 6.1.170-3Fixed in 6.1.172-1Fixed in 6.12.86-1Fixed in 6.12.88-1Fixed in 7.0.7-1 - Configuration
Disable unprivileged user namespaces to reduce exploitation surface: run `sysctl -w kernel.unprivileged_userns_clone=0`, and persist across reboots by writing `/etc/sysctl.d/99-disable-unpriv-userns.conf` with `kernel.unprivileged_userns_clone=0` and using `tee` as shown in the material.
Linux kernel sysctl kernel.unprivileged_userns_clone = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-35001?
CVE-2023-35001 is considered a high-severity vulnerability that allows local authenticated attackers to gain elevated privileges.
How do I fix CVE-2023-35001?
To fix CVE-2023-35001, update to the latest kernel versions or apply available patches from your Linux distribution.
Which systems are affected by CVE-2023-35001?
CVE-2023-35001 affects various versions of the Linux Kernel, including those from 3.13 up to 6.4.4, as well as specific products like IBM QRadar Network Packet Capture.
Can CVE-2023-35001 be exploited remotely?
No, CVE-2023-35001 requires local authenticated access, which limits the potential for remote exploitation.
What should I do if my system is vulnerable to CVE-2023-35001?
If your system is vulnerable to CVE-2023-35001, prioritize updating your kernel and monitoring for unusual behavior on your system.