CVE-2023-53635 — Incorrect Calculation in Linux

CWE-682 — Incorrect Calculation5 documents5 sources
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 96.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
LinuxLinux KernelDebian Linux
Timeline
PublishedOct 7

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: fix wrong ct->timeout value (struct nf_conn)->timeout is an interval before the conntrack confirmed. After confirmed, it becomes a timestamp. It is observed that timeout of an unconfirmed conntrack: - Set by calling ctnetlink_change_timeout(). As a result, `nfct_time_stamp` was wrongly added to `ct->timeout` twice. - Get by calling ctnetlink_dump_timeout(). As a result, `nfct_time_stamp` was wrongly subt…

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶NVDlinux/linux_kernel4.4 — 6.1.28+2
▶Debianlinux/linux_kernel< 6.1.37-1+2
▶CVEListV5linux/linuxa4b4766c3cebb4018167e06b863d8e95b7274757 — 80c5ba0078e20d926d11d0778f9a43902664ebf0+4
▶debiandebian/linux< linux 6.1.37-1 (bookworm)

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

2
OSV
CVE-2023-53635: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: fix wrong ct->timeout value (struct nf_conn)->timeout is an↗2025-10-07
▶
GHSA
GHSA-v8v9-wq25-mffx: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: fix wrong ct->timeout value (struct nf_conn)->timeout is a↗2025-10-07
▶

📋Vendor Advisories

2
Red Hat
kernel: netfilter: conntrack: fix wrong ct->timeout value↗2025-10-07
▶
Debian
CVE-2023-53635: linux - In the Linux kernel, the following vulnerability has been resolved: netfilter: ...↗2023
▶