Security readout for executives and security teams
Plain-English summary
This is a Linux kernel denial-of-service issue affecting listed Red Hat Enterprise Linux kernel packages. An attacker already holding local CAP_NET_ADMIN privileges could trigger a memory/refcount leak path and potentially make the system unavailable. It is not a remote takeover issue based on the supplied evidence.
Executive priority
Treat as a scheduled, risk-based kernel remediation item. Escalate priority for virtualization, container, network, or multi-user platforms where CAP_NET_ADMIN is delegated or easier to obtain.
Technical view
CVE-2023-7192 is a CWE-401 memory leak in ctnetlink_create_conntrack() in net/netfilter/nf_conntrack_netlink.c. The CVSS vector is local, low complexity, low privileges, no user interaction, and high availability impact. The supplied Red Hat data lists affected RHEL 8 and 9 kernel/kernel-rt streams, with RHEL 6 and 7 status unknown.
Likely exposure
Exposure is most relevant on affected Red Hat Enterprise Linux hosts where local users, services, containers, or administrators can obtain CAP_NET_ADMIN. Internet-facing status alone is not the key driver.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. Exploitation requires local privileged capability, which lowers broad external risk but matters on multi-tenant, containerized, or delegated network administration systems.
Researcher notes
Evidence supports local availability impact, not confidentiality or integrity impact. The affected matrix is Red Hat-heavy and includes multiple EUS/AUS/TUS/SAP/NFV/realtime streams. Do not assume other distributions or exploit availability from this bundle alone.
Mitigation direction
- Map systems running affected Red Hat kernel or kernel-rt packages.
- Apply the relevant Red Hat security errata after confirming product applicability.
- Prioritize multi-tenant hosts and systems granting CAP_NET_ADMIN to workloads.
- Review Red Hat guidance for RHEL 6 or 7 because status is unknown.
- Plan required kernel restart or maintenance through normal change control.
Validation and detection
- Inventory running kernel package versions against the affected Red Hat package list.
- Identify services, users, or containers with CAP_NET_ADMIN on affected hosts.
- Confirm applicable RHSA updates are installed for each supported RHEL stream.
- Verify rebooted systems are running the updated kernel, not only installed packages.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-7192 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2024:0723CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0725CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1188CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1250CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1306CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1367CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1382CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:1404CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:2006CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:2008CVE reference · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-7192CVE reference · vdb-entry, x_refsource_REDHAT
- RHBZ#2256279CVE reference · issue-tracking, x_refsource_REDHAT
- https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=ac4893980bbe79ce383daf9a0885666a30fe4c83CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.