Security readout for executives and security teams
Plain-English summary
CVE-2023-3812 is a Linux kernel flaw in the TUN/TAP network driver. A local user could trigger an out-of-bounds memory access using an oversized packet when NAPI fragments are enabled, causing a crash or possibly gaining higher privileges. This is not shown as KEV-listed in the supplied sources.
Executive priority
Treat this as a high-priority kernel maintenance issue, especially on shared Linux infrastructure. It requires local access, but successful exploitation could affect system availability and potentially privileges. No active exploitation evidence is provided, so prioritize by exposure rather than emergency incident response.
Technical view
The flaw is CWE-787 out-of-bounds memory access in tun_napi_alloc_frags. The supplied CVSS v3.1 score is 7.8: local attack vector, low complexity, low privileges, no user interaction, and high confidentiality, integrity, and availability impact. Red Hat lists affected kernel and kernel-rt builds across RHEL 8 and RHEL 9 variants.
Likely exposure
Exposure is most likely on Red Hat Enterprise Linux 8 or 9 systems running the listed affected kernel or kernel-rt packages. Risk depends on local user or workload access and the relevant TUN/TAP driver condition. The bundle does not establish exposure for non-Red Hat distributions.
Exploitation context
The supplied sources support local exploitation only. They describe a local user generating an oversized networking packet when NAPI fragments are enabled. The bundle marks KEV as false and provides no cited evidence of active exploitation in the wild.
Researcher notes
The source bundle is Red Hat-focused and lists several kpatch-patch entries as unaffected. Validate by package build and channel, not just RHEL major version. The available evidence does not identify a public exploit, active exploitation, or non-Red Hat affected product scope.
Mitigation direction
- Apply the relevant Red Hat kernel or kernel-rt security update for the affected RHEL stream.
- Use Red Hat advisories to match the exact product, package, and lifecycle channel.
- Prioritize shared, multi-user, and workload-hosting systems where local access is broader.
- If patching is delayed, check vendor guidance for supported temporary controls.
Validation and detection
- Inventory RHEL 8 and RHEL 9 hosts and installed kernel/kernel-rt package versions.
- Compare installed package builds against the affected versions in the source bundle.
- Confirm whether the host exposes TUN/TAP functionality to local users or workloads.
- Verify the relevant Red Hat advisory update is installed after remediation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-3812 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2023:6799CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:6813CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7370CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7379CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7382CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7389CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7411CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7418CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7548CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7549CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7554CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0340CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0378CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0412CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0461CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0554CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0562CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0563CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0575CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0593CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1961CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:2006CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:2008CVE reference · vendor-advisory, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.