CVE-2023-3773VulnerabilityPublished 25 Jul 2023Updated 14 Nov 2025

CVE-2023-3773: Red Hat Enterprise Linux 9 · Out-of-bounds Read

Affects Red Hat Enterprise Linux 9Source CVE Database V5

Not known to be exploited · CVSS 5.5 Medium.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

5.5Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 16% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Jul 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

To mitigate CVE-2023-3773, European organizations should implement the following specific measures: 1) Apply official Red Hat kernel patches as soon as they become available to eliminate the out-of-bounds read flaw. 2) Restrict CAP_NET_ADMIN capabilities strictly to necessary users and processes, employing the principle of least privilege to reduce the attack surface. 3) Monitor and audit netlink socket usage and network configuration changes to detect anomalous or unauthorized activity indicative of exploitation attempts. 4) Employ kernel hardening features such as SELinux or AppArmor profiles to limit access to networking subsystems. 5) In containerized or virtualized environments, carefully control capability assignments and isolate privileged containers. 6) Conduct regular security reviews of privileged accounts and implement multi-factor authentication to reduce risk of privilege compromise. 7) Educate system administrators about the risks of granting CAP_NET_ADMIN and encourage prompt reporting of suspicious behavior. 8) Use intrusion detection systems capable of monitoring kernel-level events and netlink communications for early warning signs. These targeted actions go beyond generic patching and help reduce both the likelihood and impact of exploitation.

Description

CVE-2023-3773 is a medium severity vulnerability in the Linux kernel's XFRM subsystem affecting Red Hat Enterprise Linux 9. It allows a malicious user with CAP_NET_ADMIN privileges to trigger a 4-byte out-of-bounds read when parsing netlink attributes, potentially leaking sensitive heap data to userspace. The flaw does not allow code execution or denial of service but risks confidentiality by exposing kernel memory contents. Exploitation requires local privileges and no user interaction. No known exploits are currently reported in the wild. European organizations using RHEL 9 in sensitive network environments should prioritize patching once available and restrict CAP_NET_ADMIN capabilities. Countries with significant RHEL adoption and critical infrastructure relying on Linux are most at risk. Mitigations include minimizing privileged user access, monitoring for anomalous netlink activity, and applying kernel updates promptly. The vulnerability’s CVSS score is 5.5, reflecting moderate impact primarily on confidentiality without integrity or availability compromise.

Impact

For European organizations, the primary impact of CVE-2023-3773 is the potential leakage of sensitive kernel heap data to userspace processes with CAP_NET_ADMIN privileges. This can lead to exposure of confidential information such as cryptographic keys, network configuration details, or other sensitive kernel data, which could be leveraged for further attacks or privilege escalation. Although the vulnerability does not directly allow code execution or denial of service, the confidentiality breach can undermine trust in system integrity and security. Organizations running Red Hat Enterprise Linux 9 in critical infrastructure, financial services, government, or telecommunications sectors are particularly at risk due to the sensitivity of data handled. The requirement for CAP_NET_ADMIN privileges limits the attack surface to trusted users or compromised accounts with elevated rights, but insider threats or lateral movement by attackers could exploit this vulnerability. The lack of known exploits reduces immediate risk but does not eliminate the need for vigilance. The vulnerability may also affect containerized environments or virtualized systems using RHEL 9 kernels if CAP_NET_ADMIN is granted within those contexts.

Summary

CVE-2023-3773 is a vulnerability identified in the Linux kernel's IP framework, specifically within the XFRM (transform) subsystem responsible for packet transformation and security policies. The flaw arises due to an out-of-bounds read of 4 bytes from the XFRMA_MTIMER_THRESH variable when parsing netlink attributes. This occurs when a user with CAP_NET_ADMIN privileges interacts with the netlink interface, which is used for communication between kernel and user space for networking configuration. The out-of-bounds read can lead to leakage of sensitive heap data from kernel memory to user space, potentially exposing confidential information. However, the vulnerability does not allow modification of data (integrity) or disruption of service (availability). Exploitation requires local access with CAP_NET_ADMIN privileges, which are typically granted to trusted administrators or processes. No user interaction is needed once privileges are obtained. The vulnerability affects Red Hat Enterprise Linux 9, a widely used enterprise Linux distribution, and was published on July 25, 2023. The CVSS v3.1 score is 5.5 (medium severity), with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No known exploits have been reported in the wild to date. The vulnerability highlights the risk of information disclosure through kernel memory leakage in privileged network configuration operations.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 21 Nov 2025, 15:11 UTC

Technical details

References

Community reviews

Related threats