CVE-2023-53032
published 2025-03-27CVE-2023-53032: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. When…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.20%
9.5th percentile
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
When first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of
an arithmetic expression 2 << (netmask - mask_bits - 1) is subject
to overflow due to a failure casting operands to a larger data type
before performing the arithmetic.
Note that it's harmless since the value will be checked at the next step.
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.7-1 (bookworm) | linux 6.1.7-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= b9fed748185a96b7cfe74afac4bd228e8af16f01 < e137d9bb26bd85ce07323a38e38ceb0b160db841 | e137d9bb26bd85ce07323a38e38ceb0b160db841 |
| linux | linux | >= b9fed748185a96b7cfe74afac4bd228e8af16f01 < dfd834ccc1b88bbbab81b9046a3a539dd0c2d14f | dfd834ccc1b88bbbab81b9046a3a539dd0c2d14f |
| linux | linux | >= b9fed748185a96b7cfe74afac4bd228e8af16f01 < feefb33eefa166fc3e0fd17547b0bc0cb3baced9 | feefb33eefa166fc3e0fd17547b0bc0cb3baced9 |
| linux | linux | >= b9fed748185a96b7cfe74afac4bd228e8af16f01 < 4e6a70fd840400e3a2e784a6673968a3eb2431c0 | 4e6a70fd840400e3a2e784a6673968a3eb2431c0 |
| linux | linux | >= b9fed748185a96b7cfe74afac4bd228e8af16f01 < 511cf17b2447fc41cfef8d71936e1fa53e395c1e | 511cf17b2447fc41cfef8d71936e1fa53e395c1e |
| linux | linux | >= b9fed748185a96b7cfe74afac4bd228e8af16f01 < e88865876d47c790be0d5e23973499d75d034364 | e88865876d47c790be0d5e23973499d75d034364 |
| linux | linux | >= b9fed748185a96b7cfe74afac4bd228e8af16f01 < 9ea4b476cea1b7d461d16dda25ca3c7e616e2d15 | 9ea4b476cea1b7d461d16dda25ca3c7e616e2d15 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.7-1 | 6.1.7-1 |
| linux | linux_kernel | >= 0 < 6.1.7-1 | 6.1.7-1 |
| linux | linux_kernel | >= 0 < 6.1.7-1 | 6.1.7-1 |
| linux | linux_kernel | >= 3.7 < 4.14.303 | 4.14.303 |
| linux | linux_kernel | >= 4.15 < 4.19.270 | 4.19.270 |
| linux | linux_kernel | >= 4.20 < 5.4.229 | 5.4.229 |
| linux | linux_kernel | >= 5.11 < 5.15.89 | 5.15.89 |
| linux | linux_kernel | >= 5.16 < 6.1.7 | 6.1.7 |
| linux | linux_kernel | >= 5.5 < 5.10.164 | 5.10.164 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-53032: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function
osv·2025-03-27·CVSS 5.5
CVE-2023-53032 [MEDIUM] CVE-2023-53032: In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. When first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of an arithmetic expression 2 << (netmask - mask_bits - 1) is subject to overflow due to a failure casting operands to a larger data type before performing the arithmetic. Note that it's harmless since the value will be checked at the next step. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.
GHSA
GHSA-g5qc-p7w9-v26c: In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function
ghsa_unreviewed·2025-03-27
CVE-2023-53032 [MEDIUM] CWE-190 GHSA-g5qc-p7w9-v26c: In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
When first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of
an arithmetic expression 2 << (netmask - mask_bits - 1) is subject
to overflow due to a failure casting operands to a larger data type
before performing the arithmetic.
Note that it's harmless since the value will be checked at the next step.
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.
Red Hat
kernel: netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
vendor_redhat·2025-03-27·CVSS 5.5
CVE-2023-53032 [MEDIUM] kernel: netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
kernel: netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
When first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of
an arithmetic expression 2 << (netmask - mask_bits - 1) is subject
to overflow due to a failure casting operands to a larger data type
before performing the arithmetic.
Note that it's harmless since the value will be checked at the next step.
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising
Debian
CVE-2023-53032: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ...
vendor_debian·2023·CVSS 5.5
CVE-2023-53032 [MEDIUM] CVE-2023-53032: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ...
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function. When first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of an arithmetic expression 2 << (netmask - mask_bits - 1) is subject to overflow due to a failure casting operands to a larger data type before performing the arithmetic. Note that it's harmless since the value will be checked at the next step. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE.
Scope: local
bookworm: resolved (fixed in 6.1.7-1)
bullseye: resolved (fixed in 5.10.178-1)
forky: resolved (fixed in 6.1.7-1)
sid: resolved (fixed in 6.1.7-1)
trixie: resolved (fixed in 6.1.7-1)
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/4e6a70fd840400e3a2e784a6673968a3eb2431c0https://git.kernel.org/stable/c/511cf17b2447fc41cfef8d71936e1fa53e395c1ehttps://git.kernel.org/stable/c/9ea4b476cea1b7d461d16dda25ca3c7e616e2d15https://git.kernel.org/stable/c/dfd834ccc1b88bbbab81b9046a3a539dd0c2d14fhttps://git.kernel.org/stable/c/e137d9bb26bd85ce07323a38e38ceb0b160db841https://git.kernel.org/stable/c/e88865876d47c790be0d5e23973499d75d034364https://git.kernel.org/stable/c/feefb33eefa166fc3e0fd17547b0bc0cb3baced9
2025-03-27
Published