CVE-2023-52433
Status: ModifiedHigh (7.8)—
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
New elements in this transaction might expired before such transaction ends. Skip sync GC for such elements otherwise commit path might walk over an already released object. Once transaction is finished, async GC will collect such expired element.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Base score: 7.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.25%
- Percentile among all scored CVEs: 15
- Score date: 10/1/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- CWE-273
References
- https://git.kernel.org/stable/c/03caf75da1059f0460666c826e9f50e13dfd0017
- https://git.kernel.org/stable/c/2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4
- https://git.kernel.org/stable/c/9a8c544158f68f656d1734eb5ba00c4f817b76b1
- https://git.kernel.org/stable/c/9af7dfb3c9d7985172a240f85e684c5cd33e29ce
- https://git.kernel.org/stable/c/9db9feb841f7449772f9393c16b9ef4536d8c127
- https://git.kernel.org/stable/c/c323ed65f66e5387ee0a73452118d49f1dae81b8
- https://git.kernel.org/stable/c/e3213ff99a355cda811b41e8dbb3472d13167a3a
- https://git.kernel.org/stable/c/03caf75da1059f0460666c826e9f50e13dfd0017
- https://git.kernel.org/stable/c/2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4
- https://git.kernel.org/stable/c/9a8c544158f68f656d1734eb5ba00c4f817b76b1
- https://git.kernel.org/stable/c/9af7dfb3c9d7985172a240f85e684c5cd33e29ce
- https://git.kernel.org/stable/c/9db9feb841f7449772f9393c16b9ef4536d8c127
- https://git.kernel.org/stable/c/c323ed65f66e5387ee0a73452118d49f1dae81b8
- https://git.kernel.org/stable/c/e3213ff99a355cda811b41e8dbb3472d13167a3a
- https://security.netapp.com/advisory/ntap-20240828-0003/
Raw JSON (NVD)
Show
{
"id": "CVE-2023-52433",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2023-52433",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2025-10-01T19:12:40.632777Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.4,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "HIGH",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 0.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "cb4d00b563675ba8ff6ef94b077f58d816f68ba3",
"lessThan": "9db9feb841f7449772f9393c16b9ef4536d8c127",
"versionType": "git"
},
{
"status": "affected",
"version": "c357648929c8dff891502349769aafb8f0452bc2",
"lessThan": "03caf75da1059f0460666c826e9f50e13dfd0017",
"versionType": "git"
},
{
"status": "affected",
"version": "146c76866795553dbc19998f36718d7986ad302b",
"lessThan": "c323ed65f66e5387ee0a73452118d49f1dae81b8",
"versionType": "git"
},
{
"status": "affected",
"version": "479a2cf5259347d6a1f658b0f791d27a34908e91",
"lessThan": "9af7dfb3c9d7985172a240f85e684c5cd33e29ce",
"versionType": "git"
},
{
"status": "affected",
"version": "df650d6a4bf47248261b61ef6b174d7c54034d15",
"lessThan": "9a8c544158f68f656d1734eb5ba00c4f817b76b1",
"versionType": "git"
},
{
"status": "affected",
"version": "f6c383b8c31a93752a52697f8430a71dcbc46adf",
"lessThan": "e3213ff99a355cda811b41e8dbb3472d13167a3a",
"versionType": "git"
},
{
"status": "affected",
"version": "f6c383b8c31a93752a52697f8430a71dcbc46adf",
"lessThan": "2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4",
"versionType": "git"
},
{
"status": "affected",
"version": "e4d71d6a9c7db93f7bf20c3a0f0659d63d7de681",
"versionType": "git"
},
{
"status": "affected",
"version": "6.4.11",
"lessThan": "6.5",
"versionType": "semver"
}
],
"programFiles": [
"net/netfilter/nft_set_rbtree.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.5",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.5.4",
"versionType": "semver",
"lessThanOrEqual": "6.5.*"
},
{
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/netfilter/nft_set_rbtree.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2024-02-20T13:15:08.140",
"references": [
{
"url": "https://git.kernel.org/stable/c/03caf75da1059f0460666c826e9f50e13dfd0017",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9a8c544158f68f656d1734eb5ba00c4f817b76b1",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9af7dfb3c9d7985172a240f85e684c5cd33e29ce",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9db9feb841f7449772f9393c16b9ef4536d8c127",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c323ed65f66e5387ee0a73452118d49f1dae81b8",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e3213ff99a355cda811b41e8dbb3472d13167a3a",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/03caf75da1059f0460666c826e9f50e13dfd0017",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/9a8c544158f68f656d1734eb5ba00c4f817b76b1",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/9af7dfb3c9d7985172a240f85e684c5cd33e29ce",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/9db9feb841f7449772f9393c16b9ef4536d8c127",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/c323ed65f66e5387ee0a73452118d49f1dae81b8",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://git.kernel.org/stable/c/e3213ff99a355cda811b41e8dbb3472d13167a3a",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://security.netapp.com/advisory/ntap-20240828-0003/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-273"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_rbtree: skip sync GC for new elements in this transaction\n\nNew elements in this transaction might expired before such transaction\nends. Skip sync GC for such elements otherwise commit path might walk\nover an already released object. Once transaction is finished, async GC\nwill collect such expired element."
},
{
"lang": "es",
"value": "En el kernel de Linux, se resolvió la siguiente vulnerabilidad: netfilter: nft_set_rbtree: omitir sincronización GC para nuevos elementos en esta transacción los nuevos elementos en esta transacción pueden caducar antes de que finalice dicha transacción. Omita la sincronización del GC para dichos elementos; de lo contrario, la ruta de confirmación podría pasar por encima de un objeto ya liberado. Una vez finalizada la transacción, async GC recopilará dicho elemento caducado."
}
],
"lastModified": "2026-08-04T10:18:26.420",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*",
"vulnerable": true,
"matchCriteriaId": "C2D814BE-93EC-42EF-88C5-EA7E7DF07BE5"
},
{
"criteria": "cpe:2.3:a:netapp:ontap_tools:10:*:*:*:*:vmware_vsphere:*:*",
"vulnerable": true,
"matchCriteriaId": "5333B745-F7A3-46CB-8437-8668DB08CD6F"
}
],
"operator": "OR"
}
]
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F4A73D5A-6920-4AB6-8BF8-3FB9E71AF104",
"versionEndExcluding": "6.5.4",
"versionStartIncluding": "6.5"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}