CVE-2023-52927
Published: 14 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2023-52927 is a vulnerability in the Linux kernel's netfilter subsystem, specifically affecting the nf_ct_find_expectation() function called by nf_conntrack_in(). This function currently removes the expectation (exp) entry from the hash table, but in certain scenarios—such as those involving Open vSwitch (OVS) and TC conntrack—the expectation should remain if the created connection tracking (ct) entry is not confirmed. Classified as CWE-416 (Use After Free), it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-03-14.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction. Successful exploitation enables high impacts on confidentiality, integrity, and availability, potentially through use-after-free conditions leading to arbitrary code execution, data corruption, or system crashes within the kernel context.
Mitigation is available through patches applied to Linux kernel stable branches, including commits 3fa58a6fbd1e9e5682d09cdafb08fba004cb12ec and 4914109a8e1e494c6aa9852f9e84ec77a5fc643f at git.kernel.org/stable. Debian LTS has issued announcements for affected systems, as noted in their May 2025 advisory. Further analysis is provided in the referenced blog post at seadragnol.github.io/posts/CVE-2023-52927/.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Local use-after-free in Linux kernel netfilter/conntrack allows arbitrary code execution in kernel context by low-privileged attacker, directly enabling privilege escalation.