cbcvebase.
CVE-2023-52923
published 2025-01-20

CVE-2023-52923: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction…

PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.25%
16.7th percentile
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction API to replace the old and buggy gc API and the busy mark approach. No set elements are removed from async garbage collection anymore, instead the _DEAD bit is set on so the set element is not visible from lookup path anymore. Async GC enqueues transaction work that might be aborted and retried later. rbtree and pipapo set backends does not set on the _DEAD bit from the sync GC path since this runs in control plane path where mutex is held. In this case, set elements are deactivated, removed and then released via RCU callback, sync GC never fails.

Affected

24 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.64-1 (bookworm)linux 6.1.64-1 (bookworm)
linuxlinux
linuxlinux>= 9d0982927e79049675cb6c6c04a0ebb3dad5a434 < cb4d00b563675ba8ff6ef94b077f58d816f68ba3cb4d00b563675ba8ff6ef94b077f58d816f68ba3
linuxlinux>= 9d0982927e79049675cb6c6c04a0ebb3dad5a434 < c357648929c8dff891502349769aafb8f0452bc2c357648929c8dff891502349769aafb8f0452bc2
linuxlinux>= 9d0982927e79049675cb6c6c04a0ebb3dad5a434 < 146c76866795553dbc19998f36718d7986ad302b146c76866795553dbc19998f36718d7986ad302b
linuxlinux>= 9d0982927e79049675cb6c6c04a0ebb3dad5a434 < 479a2cf5259347d6a1f658b0f791d27a34908e91479a2cf5259347d6a1f658b0f791d27a34908e91
linuxlinux>= 9d0982927e79049675cb6c6c04a0ebb3dad5a434 < df650d6a4bf47248261b61ef6b174d7c54034d15df650d6a4bf47248261b61ef6b174d7c54034d15
linuxlinux>= 9d0982927e79049675cb6c6c04a0ebb3dad5a434 < e4d71d6a9c7db93f7bf20c3a0f0659d63d7de681e4d71d6a9c7db93f7bf20c3a0f0659d63d7de681
linuxlinux>= 9d0982927e79049675cb6c6c04a0ebb3dad5a434 < f6c383b8c31a93752a52697f8430a71dcbc46adff6c383b8c31a93752a52697f8430a71dcbc46adf
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.205-15.10.205-1
linuxlinux_kernel>= 0 < 6.1.64-16.1.64-1
linuxlinux_kernel>= 0 < 6.4.11-16.4.11-1
linuxlinux_kernel>= 0 < 6.4.11-16.4.11-1
linuxlinux_kernel>= 4.1 < 4.19.3164.19.316
linuxlinux_kernel>= 4.20 < 5.4.2625.4.262
linuxlinux_kernel>= 5.11 < 5.15.1345.15.134
linuxlinux_kernel>= 5.16 < 6.1.566.1.56
linuxlinux_kernel>= 5.5 < 5.10.1985.10.198
linuxlinux_kernel>= 6.2 < 6.4.116.4.11

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.