CoreCVE
Back

MEDIUM

Kernel: refcount leak in ctnetlink_create_conntrack()

Published Jan 2, 2024

Description

A memory leak problem was found in ctnetlink_create_conntrack in net/netfilter/nf_conntrack_netlink.c in the Linux Kernel. This issue may allow a local attacker with CAP_NET_ADMIN privileges to cause a denial of service (DoS) attack due to a refcount overflow.

Affected products

Remediation

Vendor solution

Triggering this issue requires the ability to create user/net namespaces.

On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0:

# echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf

On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled.

Alternatively, skip loading the affected netfilter module (i.e., nf_conntrack_netlink) onto the system until we have a fix available. This can be done by a blacklist mechanism which will ensure the driver is not loaded at boot time. ~~~ How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~

Red Hat mitigation

Triggering this issue requires the ability to create user/net namespaces. On non-containerized deployments of Red Hat Enterprise Linux 8, you can disable user namespaces by setting user.max_user_namespaces to 0: # echo "user.max_user_namespaces=0" > /etc/sysctl.d/userns.conf # sysctl -p /etc/sysctl.d/userns.conf On containerized deployments, such as Red Hat OpenShift Container Platform, do not use this mitigation as the functionality is needed to be enabled. Alternatively, skip loading the affected netfilter module (i.e., nf_conntrack_netlink) onto the system until we have a fix available. This can be done by a blacklist mechanism which will ensure the driver is not loaded at boot time. ~~~ How do I blacklist a kernel module to prevent it from loading automatically? https://access.redhat.com/solutions/41278 ~~~

Weaknesses (1)

CWE-401

References (16)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner redhat
Published Jan 2, 2024
Updated Nov 20, 2025
Reserved Dec 30, 2023
Link CVE-2023-7192

CISA Vulnrichment

Updated Jan 16, 2024

NVD

Status Modified
Modified Jun 17, 2026
Link CVE-2023-7192

Red Hat

Severity Moderate
Public date Feb 10, 2023
Bugzilla 2256279
Link CVE-2023-7192

ENISA EUVD

Assigner redhat
Published Jan 2, 2024
Updated Nov 20, 2025
Link EUVD-2023-59373

GitHub

No data