CVE-2023-53635

MEDIUM EPSS 8.4%
Published Oct 7, 20258mo ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Oct 7, 2025 8mo ago
Last Modified Jun 17, 2026 2w ago

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: fix wrong ct->timeout value (struct nf_conn)->timeout is an interval before the conntrack confirmed. After confirmed, it becomes a timestamp. It is observed that timeout of an unconfirmed conntrack: - Set by calling ctnetlink_change_timeout(). As a result, `nfct_time_stamp` was wrongly added to `ct->timeout` twice. - Get by calling ctnetlink_dump_timeout(). As a result, `nfct_time_stamp` was wrongly subtracted. Call Trace: <TASK> dump_stack_lvl ctnetlink_dump_timeout __ctnetlink_glue_build ctnetlink_glue_build __nfqnl_enqueue_packet nf_queue nf_hook_slow ip_mc_output ? __pfx_ip_finish_output ip_send_skb ? __pfx_dst_output udp_send_skb udp_sendmsg ? __pfx_ip_generic_getfrag sock_sendmsg Separate the 2 cases in: - Setting `ct->timeout` in __nf_ct_set_timeout(). - Getting `ct->timeout` in ctnetlink_dump_timeout(). Pablo appends: Update ctnetlink to set up the timeout _after_ the IPS_CONFIRMED flag is set on, otherwise conntrack creation via ctnetlink breaks. Note that the problem described in this patch occurs since the introduction of the nfnetlink_queue conntrack support, select a sufficiently old Fixes: tag for -stable kernel to pick up this fix.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
8.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 3

VendorProductVersionRange
linuxlinux_kernel*≥4.4  –  <6.1.28
linuxlinux_kernel*≥6.2  –  <6.2.15
linuxlinux_kernel*≥6.3  –  <6.3.2

References 4

  • git.kernel.org https://git.kernel.org/stable/c/73db1b8f2bb6725b7391e85aab41fdf592b3c0c1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/80c5ba0078e20d926d11d0778f9a43902664ebf0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f612ae1ab4793701caf39386fb3b7f4b3ef44e48
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ff5e4ac8dd7be7f1faba955c5779a68571eeb0f8
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/73db1b8f2bb6725b7391e85aab41fdf592b3c0c1
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/80c5ba0078e20d926d11d0778f9a43902664ebf0
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f612ae1ab4793701caf39386fb3b7f4b3ef44e48
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ff5e4ac8dd7be7f1faba955c5779a68571eeb0f8
    Patch