CVE-2023-3106 - CVE House

Back to Database

Status published Medium CVE-2023-3106

Kernel: netlink socket crash (null pointer deref) in netlink_dump function

6.6 CVSS

Vulnerability Description

A NULL pointer dereference vulnerability was found in netlink_dump. This issue can occur when the Netlink socket receives the message(sendmsg) for the XFRM_MSG_GETSA, XFRM_MSG_GETPOLICY type message, and the DUMP flag is set and can cause a denial of service or possibly another unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is unlikely.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-3106

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Red Hat

View All →

Aap-gateway: improper path validation in gateway allows credential exfiltration

Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams

Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

Libsoup: improper handling of http vary header in libsoup caching

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Affected Vendor

Red Hat

View all reports →

Affected Software

Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9

Vulnerable Versions:

Unknown

Timeline

Official Publish: July 12th, 2023

Last Modified: November 20th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1499.004 Application or System Exploitation

T1489 Service Stop

T1203 Exploitation for Client Execution

T1190 Exploit Public-Facing Application