CVE-2023-52925
published 2025-02-05CVE-2023-52925: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't fail inserts if duplicate has expired nftables selftests fail…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.20%
10.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: don't fail inserts if duplicate has expired
nftables selftests fail:
run-tests.sh testcases/sets/0044interval_overlap_0
Expected: 0-2 . 0-3, got:
W: [FAILED] ./testcases/sets/0044interval_overlap_0: got 1
Insertion must ignore duplicate but expired entries.
Moreover, there is a strange asymmetry in nft_pipapo_activate:
It refetches the current element, whereas the other ->activate callbacks
(bitmap, hash, rhash, rbtree) use elem->priv.
Same for .remove: other set implementations take elem->priv,
nft_pipapo_remove fetches elem->priv, then does a relookup,
remove this.
I suspect this was the reason for the change that prompted the
removal of the expired check in pipapo_get() in the first place,
but skipping exired elements there makes no sense to me, this helper
is used for normal get requests, insertions (duplicate check)
and deactivate callback.
In first two cases expired elements must be skipped.
For ->deactivate(), this gets called for DELSETELEM, so it
seems to me that expired elements should be skipped as well, i.e.
delete request should fail with -ENOENT error.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.4.13-1 (forky) | linux 6.4.13-1 (forky) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 24138933b97b055d486e8064b4a1721702442a9b < 7845914f45f066497ac75b30c50dbc735e84e884 | 7845914f45f066497ac75b30c50dbc735e84e884 |
| linux | linux | >= 4.19.316 < 4.20 | 4.20 |
| linux | linux | >= 5.4.262 < 5.5 | 5.5 |
| linux | linux | >= 59dab3bf0b8fc08eb802721c0532f13dd89209b8 < 59ee68c437c562170265194a99698c805a686bb3 | 59ee68c437c562170265194a99698c805a686bb3 |
| linux | linux | >= 6.4.11 < 6.4.12 | 6.4.12 |
| linux | linux | >= 7c7e658a36f8b1522bd3586d8137e5f93a25ddc5 < af78b0489e8898a8c9449ffc0fdd2e181916f0d4 | af78b0489e8898a8c9449ffc0fdd2e181916f0d4 |
| linux | linux | >= b15ea4017af82011dd55225ce77cce3d4dfc169c < 891ca5dfe3b718b441fc786014a7ba8f517da188 | 891ca5dfe3b718b441fc786014a7ba8f517da188 |
| linux | linux | >= bd156ce9553dcaf2d6ee2c825d1a5a1718e86524 < 156369a702c33ad5434a19c3a689bfb836d4e0b8 | 156369a702c33ad5434a19c3a689bfb836d4e0b8 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.4.13-1 | 6.4.13-1 |
| linux | linux_kernel | >= 0 < 6.4.13-1 | 6.4.13-1 |
| linux | linux_kernel | >= 4.19.316 < 4.20 | 4.20 |
| linux | linux_kernel | >= 5.4.262 < 5.5 | 5.5 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-52925: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't fail inserts if duplicate has expired nftables selftes
osv·2025-02-05·CVSS 5.5
CVE-2023-52925 [MEDIUM] CVE-2023-52925: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't fail inserts if duplicate has expired nftables selftes
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't fail inserts if duplicate has expired nftables selftests fail: run-tests.sh testcases/sets/0044interval_overlap_0 Expected: 0-2 . 0-3, got: W: [FAILED] ./testcases/sets/0044interval_overlap_0: got 1 Insertion must ignore duplicate but expired entries. Moreover, there is a strange asymmetry in nft_pipapo_activate: It refetches the current element, whereas the other ->activate callbacks (bitmap, hash, rhash, rbtree) use elem->priv. Same for .remove: other set implementations take elem->priv, nft_pipapo_remove fetches elem->priv, then does a relookup, remove this. I suspect this was the reason for the change that prompted the removal of the expired check in pipapo_get() in the first place, but skip
GHSA
GHSA-cgvr-gqfv-x5mj: In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: don't fail inserts if duplicate has expired
nftables selft
ghsa_unreviewed·2025-02-05
CVE-2023-52925 [MEDIUM] GHSA-cgvr-gqfv-x5mj: In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: don't fail inserts if duplicate has expired
nftables selft
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: don't fail inserts if duplicate has expired
nftables selftests fail:
run-tests.sh testcases/sets/0044interval_overlap_0
Expected: 0-2 . 0-3, got:
W: [FAILED] ./testcases/sets/0044interval_overlap_0: got 1
Insertion must ignore duplicate but expired entries.
Moreover, there is a strange asymmetry in nft_pipapo_activate:
It refetches the current element, whereas the other ->activate callbacks
(bitmap, hash, rhash, rbtree) use elem->priv.
Same for .remove: other set implementations take elem->priv,
nft_pipapo_remove fetches elem->priv, then does a relookup,
remove this.
I suspect this was the reason for the change that prompted the
removal of the expired check in pipapo_get() in the first place,
bu
Red Hat
kernel: netfilter: nf_tables: don't fail inserts if duplicate has expired
vendor_redhat·2025-02-05·CVSS 5.5
CVE-2023-52925 [MEDIUM] CWE-390 kernel: netfilter: nf_tables: don't fail inserts if duplicate has expired
kernel: netfilter: nf_tables: don't fail inserts if duplicate has expired
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: don't fail inserts if duplicate has expired
nftables selftests fail:
run-tests.sh testcases/sets/0044interval_overlap_0
Expected: 0-2 . 0-3, got:
W: [FAILED] ./testcases/sets/0044interval_overlap_0: got 1
Insertion must ignore duplicate but expired entries.
Moreover, there is a strange asymmetry in nft_pipapo_activate:
It refetches the current element, whereas the other ->activate callbacks
(bitmap, hash, rhash, rbtree) use elem->priv.
Same for .remove: other set implementations take elem->priv,
nft_pipapo_remove fetches elem->priv, then does a relookup,
remove this.
I suspect this was the reason for the change that prompted th
Debian
CVE-2023-52925: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ...
vendor_debian·2023·CVSS 5.5
CVE-2023-52925 [MEDIUM] CVE-2023-52925: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ...
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't fail inserts if duplicate has expired nftables selftests fail: run-tests.sh testcases/sets/0044interval_overlap_0 Expected: 0-2 . 0-3, got: W: [FAILED] ./testcases/sets/0044interval_overlap_0: got 1 Insertion must ignore duplicate but expired entries. Moreover, there is a strange asymmetry in nft_pipapo_activate: It refetches the current element, whereas the other ->activate callbacks (bitmap, hash, rhash, rbtree) use elem->priv. Same for .remove: other set implementations take elem->priv, nft_pipapo_remove fetches elem->priv, then does a relookup, remove this. I suspect this was the reason for the change that prompted the removal of the expired check in pipapo_get() in the first place, but skip
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/156369a702c33ad5434a19c3a689bfb836d4e0b8https://git.kernel.org/stable/c/59ee68c437c562170265194a99698c805a686bb3https://git.kernel.org/stable/c/7845914f45f066497ac75b30c50dbc735e84e884https://git.kernel.org/stable/c/891ca5dfe3b718b441fc786014a7ba8f517da188https://git.kernel.org/stable/c/af78b0489e8898a8c9449ffc0fdd2e181916f0d4
2025-02-05
Published