Junglewise Threat Intelligence

CVE-2023-52620: Linux Kernel netfilter improper parameter validation in nf_tables

CVE-2023-52620 · Severity: low · CVSS 2.5 · Published 2024-03-21

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's networking subsystem (netfilter) that could allow a local user to cause minor system instability. The issue stems from how the system handles temporary, unnamed data sets used for network filtering. While the impact is low, an attacker could potentially exploit this to cause a partial denial of service.

Technical details

A vulnerability in the nf_tables component of the Linux kernel allowed userspace to specify timeout and garbage collection (GC) interval parameters for anonymous sets. Anonymous sets are intended for internal kernel use and are not meant to support these parameters from userspace. The fix involves adding checks in nf_tables_newset() to return -EOPNOTSUPP if the NFT_SET_ANONYMOUS flag is set alongside timeout or GC parameters. An attacker with local access and low privileges could potentially exploit this to cause a local denial of service. Patches have been backported to multiple stable kernel branches including 4.19, 5.4, 5.10, 5.15, and 6.1.

Affected products

  • Linux Linux Kernel up to (excluding) 4.19.312, 4.20 to (excluding) 5.4.274, 5.5 to (excluding) 5.10.215, 5.11 to (excluding) 5.15.151, 5.16 to (excluding) 6.1.81, 6.2 to (excluding) 6.4

Timeline

  • 2023-06-16: patched: Initial patch authored by Pablo Neira Ayuso
  • 2024-03-21: disclosed: CVE published by NVD

References

Related threats