CVE-2023-53635

published 2025-10-07

CVE-2023-53635: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: fix wrong ct->timeout value (struct nf_conn)->timeout is an interval…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: fix wrong ct->timeout value

(struct nf_conn)->timeout is an interval before the conntrack
confirmed. After confirmed, it becomes a timestamp.

It is observed that timeout of an unconfirmed conntrack:
- Set by calling ctnetlink_change_timeout(). As a result,
`nfct_time_stamp` was wrongly added to `ct->timeout` twice.
- Get by calling ctnetlink_dump_timeout(). As a result,
`nfct_time_stamp` was wrongly subtracted.

Call Trace:

dump_stack_lvl
ctnetlink_dump_timeout
__ctnetlink_glue_build
ctnetlink_glue_build
__nfqnl_enqueue_packet
nf_queue
nf_hook_slow
ip_mc_output
? __pfx_ip_finish_output
ip_send_skb
? __pfx_dst_output
udp_send_skb
udp_sendmsg
? __pfx_ip_generic_getfrag
sock_sendmsg

Separate the 2 cases in:
- Setting `ct->timeout` in __nf_ct_set_timeout().
- Getting `ct->timeout` in ctnetlink_dump_timeout().

Pablo appends:

Update ctnetlink to set up the timeout _after_ the IPS_CONFIRMED flag is
set on, otherwise conntrack creation via ctnetlink breaks.

Note that the problem described in this patch occurs since the
introduction of the nfnetlink_queue conntrack support, select a
sufficiently old Fixes: tag for -stable kernel to pick up this fix.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.37-1 (bookworm)	linux 6.1.37-1 (bookworm)
linux	linux	—	—
linux	linux	>= a4b4766c3cebb4018167e06b863d8e95b7274757 < 80c5ba0078e20d926d11d0778f9a43902664ebf0	80c5ba0078e20d926d11d0778f9a43902664ebf0
linux	linux	>= a4b4766c3cebb4018167e06b863d8e95b7274757 < ff5e4ac8dd7be7f1faba955c5779a68571eeb0f8	ff5e4ac8dd7be7f1faba955c5779a68571eeb0f8
linux	linux	>= a4b4766c3cebb4018167e06b863d8e95b7274757 < f612ae1ab4793701caf39386fb3b7f4b3ef44e48	f612ae1ab4793701caf39386fb3b7f4b3ef44e48
linux	linux	>= a4b4766c3cebb4018167e06b863d8e95b7274757 < 73db1b8f2bb6725b7391e85aab41fdf592b3c0c1	73db1b8f2bb6725b7391e85aab41fdf592b3c0c1
linux	linux_kernel	>= 0 < 6.1.37-1	6.1.37-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 4.4 < 6.1.28	6.1.28
linux	linux_kernel	>= 6.2 < 6.2.15	6.2.15
linux	linux_kernel	>= 6.3 < 6.3.2	6.3.2

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-682