CVE-2023-52923
published 2025-01-20CVE-2023-52923: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.25%
16.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: adapt set backend to use GC transaction API
Use the GC transaction API to replace the old and buggy gc API and the
busy mark approach.
No set elements are removed from async garbage collection anymore,
instead the _DEAD bit is set on so the set element is not visible from
lookup path anymore. Async GC enqueues transaction work that might be
aborted and retried later.
rbtree and pipapo set backends does not set on the _DEAD bit from the
sync GC path since this runs in control plane path where mutex is held.
In this case, set elements are deactivated, removed and then released
via RCU callback, sync GC never fails.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.64-1 (bookworm) | linux 6.1.64-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 9d0982927e79049675cb6c6c04a0ebb3dad5a434 < cb4d00b563675ba8ff6ef94b077f58d816f68ba3 | cb4d00b563675ba8ff6ef94b077f58d816f68ba3 |
| linux | linux | >= 9d0982927e79049675cb6c6c04a0ebb3dad5a434 < c357648929c8dff891502349769aafb8f0452bc2 | c357648929c8dff891502349769aafb8f0452bc2 |
| linux | linux | >= 9d0982927e79049675cb6c6c04a0ebb3dad5a434 < 146c76866795553dbc19998f36718d7986ad302b | 146c76866795553dbc19998f36718d7986ad302b |
| linux | linux | >= 9d0982927e79049675cb6c6c04a0ebb3dad5a434 < 479a2cf5259347d6a1f658b0f791d27a34908e91 | 479a2cf5259347d6a1f658b0f791d27a34908e91 |
| linux | linux | >= 9d0982927e79049675cb6c6c04a0ebb3dad5a434 < df650d6a4bf47248261b61ef6b174d7c54034d15 | df650d6a4bf47248261b61ef6b174d7c54034d15 |
| linux | linux | >= 9d0982927e79049675cb6c6c04a0ebb3dad5a434 < e4d71d6a9c7db93f7bf20c3a0f0659d63d7de681 | e4d71d6a9c7db93f7bf20c3a0f0659d63d7de681 |
| linux | linux | >= 9d0982927e79049675cb6c6c04a0ebb3dad5a434 < f6c383b8c31a93752a52697f8430a71dcbc46adf | f6c383b8c31a93752a52697f8430a71dcbc46adf |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.205-1 | 5.10.205-1 |
| linux | linux_kernel | >= 0 < 6.1.64-1 | 6.1.64-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 4.1 < 4.19.316 | 4.19.316 |
| linux | linux_kernel | >= 4.20 < 5.4.262 | 5.4.262 |
| linux | linux_kernel | >= 5.11 < 5.15.134 | 5.15.134 |
| linux | linux_kernel | >= 5.16 < 6.1.56 | 6.1.56 |
| linux | linux_kernel | >= 5.5 < 5.10.198 | 5.10.198 |
| linux | linux_kernel | >= 6.2 < 6.4.11 | 6.4.11 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: netfilter: nf_tables: adapt set backend to use GC transaction API
vendor_redhat·2025-01-20·CVSS 5.5
CVE-2023-52923 [MEDIUM] CWE-99 kernel: netfilter: nf_tables: adapt set backend to use GC transaction API
kernel: netfilter: nf_tables: adapt set backend to use GC transaction API
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: adapt set backend to use GC transaction API
Use the GC transaction API to replace the old and buggy gc API and the
busy mark approach.
No set elements are removed from async garbage collection anymore,
instead the _DEAD bit is set on so the set element is not visible from
lookup path anymore. Async GC enqueues transaction work that might be
aborted and retried later.
rbtree and pipapo set backends does not set on the _DEAD bit from the
sync GC path since this runs in control plane path where mutex is held.
In this case, set elements are deactivated, removed and then released
via RCU callback, sync GC never fails.
Package: kern
Debian
CVE-2023-52923: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ...
vendor_debian·2023·CVSS 5.5
CVE-2023-52923 [MEDIUM] CVE-2023-52923: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ...
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction API to replace the old and buggy gc API and the busy mark approach. No set elements are removed from async garbage collection anymore, instead the _DEAD bit is set on so the set element is not visible from lookup path anymore. Async GC enqueues transaction work that might be aborted and retried later. rbtree and pipapo set backends does not set on the _DEAD bit from the sync GC path since this runs in control plane path where mutex is held. In this case, set elements are deactivated, removed and then released via RCU callback, sync GC never fails.
Scope: local
bookworm: resolved (fixed in 6.1.64-1)
bullseye: resolved (fixed in 5.10.205
GHSA
GHSA-f2qv-j847-m6vp: In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: adapt set backend to use GC transaction API
Use the GC tra
ghsa_unreviewed·2025-01-20
CVE-2023-52923 [MEDIUM] GHSA-f2qv-j847-m6vp: In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: adapt set backend to use GC transaction API
Use the GC tra
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: adapt set backend to use GC transaction API
Use the GC transaction API to replace the old and buggy gc API and the
busy mark approach.
No set elements are removed from async garbage collection anymore,
instead the _DEAD bit is set on so the set element is not visible from
lookup path anymore. Async GC enqueues transaction work that might be
aborted and retried later.
rbtree and pipapo set backends does not set on the _DEAD bit from the
sync GC path since this runs in control plane path where mutex is held.
In this case, set elements are deactivated, removed and then released
via RCU callback, sync GC never fails.
OSV
CVE-2023-52923: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC trans
osv·2025-01-20·CVSS 5.5
CVE-2023-52923 [MEDIUM] CVE-2023-52923: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC trans
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction API to replace the old and buggy gc API and the busy mark approach. No set elements are removed from async garbage collection anymore, instead the _DEAD bit is set on so the set element is not visible from lookup path anymore. Async GC enqueues transaction work that might be aborted and retried later. rbtree and pipapo set backends does not set on the _DEAD bit from the sync GC path since this runs in control plane path where mutex is held. In this case, set elements are deactivated, removed and then released via RCU callback, sync GC never fails.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/146c76866795553dbc19998f36718d7986ad302bhttps://git.kernel.org/stable/c/479a2cf5259347d6a1f658b0f791d27a34908e91https://git.kernel.org/stable/c/c357648929c8dff891502349769aafb8f0452bc2https://git.kernel.org/stable/c/cb4d00b563675ba8ff6ef94b077f58d816f68ba3https://git.kernel.org/stable/c/df650d6a4bf47248261b61ef6b174d7c54034d15https://git.kernel.org/stable/c/e4d71d6a9c7db93f7bf20c3a0f0659d63d7de681https://git.kernel.org/stable/c/f6c383b8c31a93752a52697f8430a71dcbc46adf
2025-01-20
Published