CVE-2023-52927

EUVD-2023-59682

14.03.2025, 15:15

In the Linux kernel, the following vulnerability has been resolved:

netfilter: allow exp not to be removed in nf_ct_find_expectation

Currently nf_conntrack_in() calling nf_ct_find_expectation() will
remove the exp from the hash table. However, in some scenario, we
expect the exp not to be removed when the created ct will not be
confirmed, like in OVS and TC conntrack in the following patches.

This patch allows exp not to be removed by setting IPS_CONFIRMED
in the status of the tmpl.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.8 HIGH	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 22%

Affected Products (NVD)

Vendor	Product	Version
linux	linux_kernel	5.18 ≤ 𝑥 < 6.1.130
linux	linux_kernel	6.2 ≤ 𝑥 < 6.6
debian	debian_linux	11.0

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	V3.1.6 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518-4 PN/DP MFP	V3.1.6 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	V3.1.6 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP	V3.1.6 ≤ 𝑥 < *	ADP
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	V3.1.5 ≤ 𝑥 < *	ADP
Siemens	SIPLUS S7-1500 CPU 1518-4 PN/DP MFP	V3.1.6 ≤ 𝑥 < *	ADP

Debian Releases

Debian Product

Codename

linux

bookworm	vulnerable
bookworm (security)	vulnerable
bullseye	vulnerable
bullseye (security)	vulnerable
sid	6.12.17-1 fixed
trixie	6.12.17-1 fixed

openSUSE / SLES Releases

openSUSE Product

Release

cluster-md-kmp-default

suse enterprise server 12 SP5	4.12.14-122.266.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.116.1 fixed

dlm-kmp-default

suse enterprise server 12 SP5	4.12.14-122.266.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.116.1 fixed

gfs2-kmp-default

suse enterprise server 12 SP5	4.12.14-122.266.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.116.1 fixed

kernel-64kb

suse enterprise desktop 15 SP6	6.4.0-150600.23.47.2 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.47.2 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.215.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.173.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.116.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.47.2 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1 fixed

kernel-azure

suse enterprise sap 15 SP6	6.4.0-150600.8.34.2 fixed
suse enterprise sap 15 SP7	6.4.0-150700.20.3.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.8.34.2 fixed
suse enterprise server 15 SP7	6.4.0-150700.20.3.1 fixed

kernel-default

suse enterprise desktop 15 SP6	6.4.0-150600.23.47.2 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.47.2 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise server 12 SP5	4.12.14-122.266.1 fixed
suse enterprise server 15 SP2	5.3.18-150200.24.236.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.215.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.173.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.116.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.47.2 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1 fixed

kernel-default-base

suse enterprise desktop 15 SP6	6.4.0-150600.23.47.2.150600.12.20.2 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1.150700.17.2.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.47.2.150600.12.20.2 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1.150700.17.2.1 fixed
suse enterprise server 12 SP5	4.12.14-122.266.1 fixed
suse enterprise server 15 SP2	5.3.18-150200.24.236.1.150200.9.128.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.215.1.150300.18.128.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.173.1.150400.24.88.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.116.1.150500.6.55.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.47.2.150600.12.20.2 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1.150700.17.2.1 fixed

kernel-default-man

suse enterprise server 12 SP5

4.12.14-122.266.1

fixed

kernel-obs-build

suse enterprise desktop 15 SP6	6.4.0-150600.23.47.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.47.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise server 15 SP2	5.3.18-150200.24.236.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.215.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.173.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.116.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.47.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1 fixed

kernel-preempt

suse enterprise server 15 SP2	5.3.18-150200.24.236.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.215.1 fixed

kernel-source

suse enterprise desktop 15 SP6	6.4.0-150600.23.47.2 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.47.2 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise server 12 SP5	4.12.14-122.266.1 fixed
suse enterprise server 15 SP2	5.3.18-150200.24.236.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.215.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.173.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.116.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.47.2 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1 fixed

kernel-source-azure

suse enterprise sap 15 SP6	6.4.0-150600.8.34.2 fixed
suse enterprise sap 15 SP7	6.4.0-150700.20.3.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.8.34.2 fixed
suse enterprise server 15 SP7	6.4.0-150700.20.3.1 fixed

kernel-zfcpdump

suse enterprise desktop 15 SP6	6.4.0-150600.23.47.2 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.47.2 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.215.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.173.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.116.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.47.2 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1 fixed

ocfs2-kmp-default

suse enterprise server 12 SP5	4.12.14-122.266.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.116.1 fixed

reiserfs-kmp-default

suse enterprise server 15 SP2	5.3.18-150200.24.236.1 fixed
suse enterprise server 15 SP3	5.3.18-150300.59.215.1 fixed
suse enterprise server 15 SP4	5.14.21-150400.24.173.1 fixed
suse enterprise server 15 SP5	5.14.21-150500.55.116.1 fixed

Amazon Linux Releases

Amazon Package

Release

bpftool

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

bpftool-debuginfo

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

kernel

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

kernel-debuginfo

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

kernel-debuginfo-common-aarch64

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

kernel-debuginfo-common-x86_64

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

kernel-devel

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

kernel-headers

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

kernel-libbpf

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

kernel-libbpf-devel

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

kernel-libbpf-static

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

kernel-livepatch-6.1.130-139.222

Amazon Linux 2023

0:1.0-0.amzn2023

fixed

kernel-modules-extra

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

kernel-modules-extra-common

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

kernel-tools

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

kernel-tools-debuginfo

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

kernel-tools-devel

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

perf

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

perf-debuginfo

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

python3-perf

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

python3-perf-debuginfo

Amazon Linux 2023

0:6.1.130-139.222.amzn2023

fixed

Known Exploits!

https://seadragnol.github.io/posts/CVE-2023-52927/

Common Weakness Enumeration

CWE-416 - Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

References

https://git.kernel.org/stable/c/3fa58a6fbd1e9e5682d09cdafb08fba004cb12ec

https://git.kernel.org/stable/c/4914109a8e1e494c6aa9852f9e84ec77a5fc643f

https://seadragnol.github.io/posts/CVE-2023-52927/

https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html

https://cert-portal.siemens.com/productcert/html/ssa-019113.html

https://cert-portal.siemens.com/productcert/html/ssa-082556.html