CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation
In the Linux kernel, the following vulnerability has been resolved:
netfilter: allow exp not to be removed in nfctfindexpectation
Currently nfconntrackin() calling nfctfindexpectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct will not be confirmed, like in OVS and TC conntrack in the following patches.
This patch allows exp not to be removed by setting IPSCONFIRMED in the status of the tmpl.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.135-1Fixed in 6.12.27-1 - Configuration
Set IPS_CONFIRMED in the status of the tmpl for nf_ct_find_expectation so the expectation (exp) is not removed from the hash table when the created connection tracking (ct) will not be confirmed (as described for OVS and TC conntrack).
Linux kernel netfilter (nf_ct_find_expectation / expectation status tmpl) IPS_CONFIRMED = set (allow exp not to be removed)
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52927?
CVE-2023-52927 is considered a high-severity vulnerability due to its potential impact on the Linux kernel's connection tracking functionality.
How do I fix CVE-2023-52927?
To fix CVE-2023-52927, upgrade your Linux kernel to the latest version that includes the security patch for this vulnerability.
What impact does CVE-2023-52927 have on system security?
CVE-2023-52927 could lead to unexpected behavior in packet filtering and connection tracking, potentially allowing unauthorized access.
Which versions of the Linux kernel are affected by CVE-2023-52927?
CVE-2023-52927 affects multiple versions of the Linux kernel prior to the application of available patches.
Is there a public exploit available for CVE-2023-52927?
As of now, there are no public exploits confirmed for CVE-2023-52927, but due diligence is advised.