CVE-2023-4194VulnerabilityPublished 7 Aug 2023Updated 14 Nov 2025

CVE-2023-4194: Red Hat Enterprise Linux 9 · Incorrect Authorization

Affects Red Hat Enterprise Linux 9Source CVE Database V5

Mentioned vulnerabilities

CVE-2023-1076

Not known to be exploited · CVSS 5.5 Medium.

Data as of 26 Oct 2026, 06:26 UTC

CVSS 3.1 base score

5.5Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 18% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Local: The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., tricking a legitimate user into opening a malicious document).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 7 Aug 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-26.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

To mitigate CVE-2023-4194, European organizations should prioritize applying official kernel patches from Red Hat as soon as they are released, ensuring that the TUN/TAP driver correctly initializes socket UIDs to enforce proper authorization. Until patches are available, administrators should restrict local user access on systems running RHEL 9, especially limiting access to untrusted users or service accounts. Employing mandatory access control frameworks such as SELinux or AppArmor can provide additional containment of network-related operations. Network administrators should audit and monitor usage of TUN/TAP interfaces to detect unusual activity that might indicate exploitation attempts. Additionally, reviewing and tightening firewall and network filter configurations can reduce the attack surface. For environments using containerization or virtualization, isolating network namespaces and limiting capabilities related to TUN/TAP devices can further reduce risk. Regular vulnerability scanning and compliance checks should include verification of patch status for this CVE. Finally, educating system administrators about the risks of local privilege misuse and enforcing the principle of least privilege will help mitigate exploitation opportunities.

Description

CVE-2023-4194 is a medium-severity vulnerability in the Linux kernel's TUN/TAP network interface implementation affecting Red Hat Enterprise Linux 9. It allows a local user with limited privileges to bypass network filtering controls and gain unauthorized access to certain resources due to incorrect initialization of socket user IDs. The vulnerability stems from incomplete or incorrect patches addressing a previous flaw (CVE-2023-1076), specifically related to passing inaccurate user ID parameters in kernel code. Exploitation requires local access and no user interaction, with no direct impact on confidentiality but a high impact on integrity by enabling privilege bypass. No known exploits are currently in the wild. European organizations using RHEL 9 in environments where local user access is possible, such as multi-tenant or shared systems, are at risk. Mitigation involves applying updated kernel patches once available and restricting local user privileges. Countries with significant enterprise Linux deployments, such as Germany, France, and the UK, are most likely affected.

Impact

For European organizations, the primary impact of CVE-2023-4194 lies in the potential for local users to circumvent network filtering controls, which could lead to unauthorized network access or interference with network traffic. This is particularly concerning in multi-user or multi-tenant environments such as shared hosting providers, cloud platforms, or enterprise servers where multiple users have local access. Although the vulnerability does not directly expose sensitive data (no confidentiality impact), it undermines the integrity of network security policies and could facilitate lateral movement or privilege escalation attacks. Organizations relying on Red Hat Enterprise Linux 9 for critical infrastructure, especially those using TUN/TAP interfaces for VPNs, container networking, or virtualized environments, may face increased risk of internal threat actors exploiting this flaw. The absence of known exploits reduces immediate risk, but the vulnerability should be addressed promptly to prevent potential abuse. Disruption of network filtering can also affect compliance with European data protection regulations if unauthorized network access leads to data exposure.

Summary

CVE-2023-4194 is a vulnerability identified in the Linux kernel's TUN/TAP driver, which provides virtual network interfaces used for tunneling and network packet processing. The flaw arises from incorrect authorization logic due to improper initialization of the socket's user ID (UID) within the tun_chr_open() and tap_open() functions. Specifically, the kernel code passes the inode's UID to sock_init_data_uid(), but this UID is inaccurate, leading to a failure in enforcing proper access controls. This issue is a regression or incomplete fix related to a prior vulnerability (CVE-2023-1076), where the original patches did not fully address the root cause. As a result, a local user with limited privileges can bypass network filters implemented via TUN/TAP interfaces, potentially gaining unauthorized access to network resources or interfering with network traffic. The vulnerability requires local access and low complexity to exploit, with no need for user interaction. It does not directly compromise confidentiality but can impact system integrity by allowing unauthorized network operations. The vulnerability affects Red Hat Enterprise Linux 9, which is widely used in enterprise environments. No public exploits have been reported yet, but the medium CVSS score (5.5) reflects the moderate risk posed by the flaw. The issue highlights the importance of accurate UID handling in kernel networking components to enforce security boundaries effectively.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 21 Nov 2025, 15:12 UTC

Technical details

References

Community reviews

Related threats