Junglewise Threat Intelligence

CVE-2023-52927: Linux Kernel Netfilter use-after-free in nf_conntrack

CVE-2023-52927 · Severity: high · CVSS 7.8 · Published 2025-03-14

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to gain elevated privileges. The issue exists in the Netfilter component, which manages network traffic and firewall rules. An attacker could exploit this flaw to crash the system or execute unauthorized code, potentially compromising the entire server.

Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel's Netfilter conntrack (nf_conntrack) module. The root cause is located in the `nf_ct_find_expectation` function, where certain scenarios involving Open vSwitch (OVS) or Traffic Control (TC) conntrack could lead to an expectation being prematurely removed from the hash table or improperly handled when a connection is not confirmed. Specifically, a template connection (tmpl) could be freed while still being referenced in the NAT source hash table (nf_nat_bysource). A local attacker with low privileges can trigger this UAF to achieve arbitrary kernel memory read/write and local privilege escalation. The fix involves ensuring the `IPS_CONFIRMED` bit is set in the template status to prevent incorrect unlinking.

Affected products

  • Linux Linux Kernel 5.18 to 6.1.130, 6.2 to 6.6

Timeline

  • 2023-07-16: patched: Initial patch authored by Xin Long
  • 2025-03-14: advisory: CVE-2023-52927 published by NVD
  • 2025-07-05: other: Public exploit research published by SeaDragnoL

References

Related threats