USN-8630-3: Ubuntu Linux Kernel (Oracle) Vulnerabilities — 16 CVEs Across Netfilter, TCP, IPv6, and SCTP Require Immediate Patching

---
title: Unprivileged User Namespace Creation Followed by Privileged Transition
description: Detects a non-root process creating a user namespace (clone/unshare with CLONE_NEWUSER) and subsequently executing a setuid or root-owned process. Kernel LPE exploits targeting Netfilter, tc, and packet subsystems almost universally require unprivileged user namespaces to reach the vulnerable code paths. Relevant to CVE classes addressed in USN-8630-3 (Netfilter, tc, SCTP, TCP).
references:
  - https://ubuntu.com/security/notices/USN-8630-3
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
id: 3f8a2c71-9b4e-4d5a-8e6f-1a2b3c4d5e6f
status: experimental
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: linux
  category: process_creation
detection:
  selection_tools:
    Image|endswith:
      - '/unshare'
      - '/nsenter'
  selection_flags:
    CommandLine|contains:
      - '--user'
      - '-U'
      - 'CLONE_NEWUSER'
  condition: selection_tools and selection_flags
falsepositives:
  - Container runtimes (podman, rootless docker) legitimately create user namespaces; filter by parent process and known runtime paths
  - Flatpak and sandboxed desktop applications
level: medium
---
title: Suspicious nftables or tc Rule Manipulation by Non-System Process
description: Detects invocation of nft, tc, or iptables by processes running from non-standard paths or by users outside expected administrative contexts. Netfilter and traffic-control subsystem exploits (classes patched in USN-8630-3, e.g. CVE-2026-43083 and related) frequently stage malicious rules or heap-spray via these interfaces before triggering the bug.
references:
  - https://ubuntu.com/security/notices/USN-8630-3
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
id: 7b1e4d92-3c5f-4a8b-9d2e-5f6a7b8c9d0e
status: experimental
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.defense_evasion
  - attack.t1068
  - attack.t1562
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/nft'
      - '/tc'
      - '/iptables'
      - '/ip6tables'
  filter_legit_parents:
    ParentImage|endswith:
      - '/systemd'
      - '/sshd'
      - '/sudo'
      - '/cloud-init'
      - '/ansible'
  condition: selection and not filter_legit_parents
falsepositives:
  - Configuration management (Ansible, Chef, Puppet) — extend the parent filter to match your CM tooling
  - Kubernetes kube-proxy manipulates iptables heavily; exclude cluster node agents
level: medium
---
title: Unexpected setuid Execution Originating from Writable Directories
description: Detects execution of binaries from world-writable or temporary directories that result in root-owned processes, a hallmark of a successful kernel LPE dropping and running a post-exploitation payload. Serves as a second-stage tripwire behind the namespace and Netfilter detections for the USN-8630-3 CVE set.
references:
  - https://ubuntu.com/security/notices/USN-8630-3
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
id: 9c2f5a83-4d6e-4b7c-8a1f-2b3c4d5e6f7a
status: experimental
date: 2026/04/06
tags:
  - attack.privilege_escalation
  - attack.execution
  - attack.t1068
logsource:
  product: linux
  category: process_creation
detection:
  selection_path:
    Image|startswith:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/run/user/'
  selection_root:
    User: 'root'
  condition: selection_path and selection_root
falsepositives:
  - Legitimate installers executing from /tmp (rare on hardened production systems); tune per environment
  - Packer/image-build pipelines on build hosts
level: high

// USN-8630-3 hunt: kernel LPE primitives on Oracle-flavor Ubuntu hosts
// Requires Syslog (auditd/execve) or Sysmon-for-Linux ingestion into Sentinel
let Lookback = 7d;
let SuspiciousTools = dynamic(["unshare", "nsenter", "nft", "tc", "iptables", "ip6tables"]);
Syslog
| where TimeGenerated > ago(Lookback)
| where Facility == "auth" or ProcessName in (SuspiciousTools)
| where SyslogMessage has_any ("unshare", "CLONE_NEWUSER", "nft ", "tc ", "iptables")
| extend Tool = extract(@"(unshare|nsenter|nft|tc|iptables|ip6tables)", 1, SyslogMessage)
| extend CmdLine = SyslogMessage
| summarize Executions = count(), DistinctUsers = dcount(HostIP), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by Computer, Tool, CmdLine
| where Executions < 20  // suppress high-frequency legitimate automation, surface outliers
| order by LastSeen desc;
// Companion query: hosts whose running kernel predates the USN-8630-3 fix
// (populate kernel version via heartbeat custom field or a watcher that logs `uname -r`)
Heartbeat
| where TimeGenerated > ago(1d)
| where OSType == "Linux"
| summarize arg_max(TimeGenerated, *) by Computer
| project Computer, OSName, OSMajorVersion, OSMinorVersion, TimeGenerated;

-- USN-8630-3 triage: kernel version, netfilter modules, and suspicious exec paths
SELECT {
  SELECT Name, Pid, PPid, Exe, CommandLine, Username, CreateTime
  FROM pslist()
  WHERE Exe =~ '^(?i)(/tmp|/var/tmp|/dev/shm|/run/user)/'
     OR CommandLine =~ '(?i)unshare|CLONE_NEWUSER|nft |tc (filter|qdisc|class) '
} AS SuspiciousProcesses,
{
  SELECT * FROM execve(argv=['uname', '-r'])
} AS RunningKernel,
{
  SELECT Name, Size, UsedBy
  FROM parse_file(filename='/proc/modules')
} AS LoadedModules
FROM scope()

#!/bin/bash
# USN-8630-3 remediation and verification — Ubuntu linux-oracle kernel
# Run with sudo. Exit codes: 0 = compliant, 1 = action required, 2 = not applicable

set -euo pipefail

RUNNING=$(uname -r)
echo "[i] Running kernel: ${RUNNING}"

# 1. Confirm this host runs the Oracle kernel flavor
if [[ "${RUNNING}" != *oracle* ]] && ! dpkg -l 2>/dev/null | grep -q 'linux-image.*oracle'; then
  echo "[i] linux-oracle flavor not present — USN-8630-3 not applicable (check your flavor's USN)"
  exit 2
fi

# 2. Apply the kernel update
apt-get update -qq
apt-get install --only-upgrade -y linux-image-oracle linux-headers-oracle 2>/dev/null || \
  apt-get dist-upgrade -y

INSTALLED=$(dpkg -l | awk '/linux-image-[0-9].*oracle/ {print $3}' | sort -V | tail -1)
echo "[i] Newest installed oracle kernel: ${INSTALLED}"

# 3. Check reboot requirement
if [[ -f /var/run/reboot-required ]]; then
  echo "[!] REBOOT REQUIRED. Pending kernel: ${INSTALLED}"
  cat /var/run/reboot-required.pkgs 2>/dev/null || true
  exit 1
fi

# 4. Post-reboot verification: running kernel must match newest installed
if [[ "${RUNNING}" == *"${INSTALLED%%-*}"* ]]; then
  echo "[+] Running kernel matches patched package — compliant"
  exit 0
else
  echo "[!] Running kernel (${RUNNING}) does not match patched package (${INSTALLED}) — reboot pending"
  exit 1
fi

# Disable unprivileged user namespaces — blocks the reachability path for most
# Netfilter/tc/SCTP LPE chains. Validate container workloads first (rootless podman breaks).
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' > /etc/sysctl.d/90-usn-8630.conf

# Restrict BPF to root only — many kernel exploit chains use eBPF for heap grooming
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/90-usn-8630.conf

# Blacklist modules not required in your environment (each is a patched, network-reachable subsystem)
cat > /etc/modprobe.d/usn-8630-blacklist.conf <<'EOF'
# Review before applying — only blacklist subsystems you do NOT use
install batman_adv /bin/false
install rxrpc /bin/false
install sctp /bin/false
install smc /bin/false
install mptcp /bin/false
EOF