369 lines
17 KiB
JSON
369 lines
17 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2023-52620",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2024-03-06T09:52:12.090Z",
|
||
"datePublished": "2024-03-21T10:43:42.854Z",
|
||
"dateUpdated": "2026-10-15T00:17:04.581Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T09:10:45.446Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: disallow timeout for anonymous sets\n\nNever used from userspace, disallow these parameters."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 7.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - The bug is triggered via the nfnetlink/nf_tables control plane (NFT_MSG_NEWSET with timeout attributes on an anonymous set, then rule delete), which requires a local netlink socket; nftables netlink is a Local attack vector.\nAC:L - The attacker fully controls both sides of the race by setting NFTA_SET_TIMEOUT/NFTA_SET_GC_INTERVAL (driving async rhash/pipapo GC frequency and element expiry) and issuing the unbind/delete transaction, and can retry indefinitely until the GC batch races with set teardown.\nPR:L - nfnetlink_rcv() only requires CAP_NET_ADMIN in the network namespace’s user_ns via netlink_net_capable(), which an unprivileged user obtains with unshare -Urn; nftables is fully functional per-netns.\nUI:N - Creating the anonymous timeout set, populating expiring elements, and deleting the binding rule are all performed by the attacker’s own process with no victim action.\nS:U - The resulting use-after-free corrupts kernel heap state within the same kernel security authority; this is standard local privilege escalation with no VM/IOMMU/sandbox boundary crossed.\nC:H - The GC-vs-destroy race yields a use-after-free on nft_rhash_elem/set objects whose size and contents the attacker chooses, enabling heap spray and arbitrary kernel memory disclosure; per guidance any UAF is Confidentiality High.\nI:H - Concurrent GC removal and set destroy produce UAF/double-free of attacker-sized slab objects—the same nftables heap-corruption primitive class used for local privilege escalation (as in related CVE-2024-26642/26643)—so Integrity is High.\nA:H - Even without successful exploitation, the UAF/double-free on set elements and the destroyed rhashtable causes slab corruption and kernel oops/panic, and the attacker can trigger it repeatedly."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"net/netfilter/nf_tables_api.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "761da2935d6e18d178582dbdf315a3a458555505",
|
||
"lessThan": "116b0e8e4673a5faa8a739a19b467010c4d3058c",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "761da2935d6e18d178582dbdf315a3a458555505",
|
||
"lessThan": "49ce99ae43314d887153e07cec8bb6a647a19268",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "761da2935d6e18d178582dbdf315a3a458555505",
|
||
"lessThan": "6f3ae02bbb62f151b19162d5fdc9fe3d48450323",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "761da2935d6e18d178582dbdf315a3a458555505",
|
||
"lessThan": "00b19ee0dcc1aef06294471ab489bae26d94524e",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "761da2935d6e18d178582dbdf315a3a458555505",
|
||
"lessThan": "b7be6c737a179a76901c872f6b4c1d00552d9a1b",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "761da2935d6e18d178582dbdf315a3a458555505",
|
||
"lessThan": "e26d3009efda338f19016df4175f354a9bd0a4ab",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"net/netfilter/nf_tables_api.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "4.1",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "4.1",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.19.312",
|
||
"lessThanOrEqual": "4.19.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.4.274",
|
||
"lessThanOrEqual": "5.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.215",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.151",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.1.81",
|
||
"lessThanOrEqual": "6.1.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.4",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.1",
|
||
"versionEndExcluding": "4.19.312"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.1",
|
||
"versionEndExcluding": "5.4.274"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.1",
|
||
"versionEndExcluding": "5.10.215"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.1",
|
||
"versionEndExcluding": "5.15.151"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.1",
|
||
"versionEndExcluding": "6.1.81"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.1",
|
||
"versionEndExcluding": "6.4"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/116b0e8e4673a5faa8a739a19b467010c4d3058c"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/49ce99ae43314d887153e07cec8bb6a647a19268"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/6f3ae02bbb62f151b19162d5fdc9fe3d48450323"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/00b19ee0dcc1aef06294471ab489bae26d94524e"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/b7be6c737a179a76901c872f6b4c1d00552d9a1b"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/e26d3009efda338f19016df4175f354a9bd0a4ab"
|
||
}
|
||
],
|
||
"title": "netfilter: nf_tables: disallow timeout for anonymous sets",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"type": "CWE",
|
||
"lang": "en",
|
||
"description": "CWE-noinfo Not enough information"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"scope": "UNCHANGED",
|
||
"version": "3.1",
|
||
"baseScore": 2.5,
|
||
"attackVector": "LOCAL",
|
||
"baseSeverity": "LOW",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
|
||
"integrityImpact": "NONE",
|
||
"userInteraction": "NONE",
|
||
"attackComplexity": "HIGH",
|
||
"availabilityImpact": "LOW",
|
||
"privilegesRequired": "LOW",
|
||
"confidentialityImpact": "NONE"
|
||
}
|
||
},
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2024-06-26T20:33:31.634112Z",
|
||
"id": "CVE-2023-52620",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-11-06T20:01:21.818Z"
|
||
}
|
||
},
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-02T23:03:21.362Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/116b0e8e4673a5faa8a739a19b467010c4d3058c",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/49ce99ae43314d887153e07cec8bb6a647a19268",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/6f3ae02bbb62f151b19162d5fdc9fe3d48450323",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/00b19ee0dcc1aef06294471ab489bae26d94524e",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/b7be6c737a179a76901c872f6b4c1d00552d9a1b",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/e26d3009efda338f19016df4175f354a9bd0a4ab",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"x_adpType": "supplier",
|
||
"providerMetadata": {
|
||
"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
|
||
"shortName": "siemens-SADP",
|
||
"dateUpdated": "2026-10-15T00:17:04.581Z"
|
||
},
|
||
"affected": [
|
||
{
|
||
"vendor": "Siemens",
|
||
"product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem",
|
||
"versions": [
|
||
{
|
||
"status": "affected",
|
||
"version": "0",
|
||
"lessThan": "V1.1.1",
|
||
"versionType": "custom"
|
||
}
|
||
],
|
||
"defaultStatus": "unknown"
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
},
|
||
"dataVersion": "5.2"
|
||
} |