Vulnerability · Published Mar 2, 2024 · Assigned by Linux
CVE-2023-52581netfilter: nf_tables: fix memleak when more than 255 elements expired
Medium 6.3
In plain English
A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 82.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak when more than 255 elements expired When more than 255 elements expired we're supposed to switch to a new gc container structure. This never happens: u8 type will wrap before reaching the boundary and nft_trans_gc_space() always returns true. This means we recycle the initial gc container structure and lose track of the elements that came before. While at it, don't deref 'gc' after we've passed it to call_rcu.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | bpftool | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | bpftool | 7.3.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-debug-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-64k-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-abi-stablelists | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-abi-stablelists | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-core | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-cross-headers | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-cross-headers | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-debug | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-debug | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-debug-core | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-debug-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-debug-devel | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-debug-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-debug-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-debug-modules | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-debug-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-debug-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-debug-modules-extra | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-debug-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-debug-uki-virt | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-devel | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-doc | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-doc | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-headers | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-headers | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-modules | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-modules-extra | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-rt | 4.18.0-553.rt7.342.el8_10 | ALSA-2024:2950 |
| AlmaLinux:9 | kernel-rt | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-rt-core | 4.18.0-553.rt7.342.el8_10 | ALSA-2024:2950 |
| AlmaLinux:9 | kernel-rt-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-rt-debug | 4.18.0-553.rt7.342.el8_10 | ALSA-2024:2950 |
| AlmaLinux:9 | kernel-rt-debug | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-rt-debug-core | 4.18.0-553.rt7.342.el8_10 | ALSA-2024:2950 |
| AlmaLinux:9 | kernel-rt-debug-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-rt-debug-devel | 4.18.0-553.rt7.342.el8_10 | ALSA-2024:2950 |
| AlmaLinux:9 | kernel-rt-debug-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-rt-debug-kvm | 4.18.0-553.rt7.342.el8_10 | ALSA-2024:2950 |
| AlmaLinux:8 | kernel-rt-debug-modules | 4.18.0-553.rt7.342.el8_10 | ALSA-2024:2950 |
| AlmaLinux:9 | kernel-rt-debug-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-debug-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-rt-debug-modules-extra | 4.18.0-553.rt7.342.el8_10 | ALSA-2024:2950 |
| AlmaLinux:9 | kernel-rt-debug-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-rt-devel | 4.18.0-553.rt7.342.el8_10 | ALSA-2024:2950 |
| AlmaLinux:9 | kernel-rt-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-rt-kvm | 4.18.0-553.rt7.342.el8_10 | ALSA-2024:2950 |
| AlmaLinux:8 | kernel-rt-modules | 4.18.0-553.rt7.342.el8_10 | ALSA-2024:2950 |
| AlmaLinux:9 | kernel-rt-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-rt-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-rt-modules-extra | 4.18.0-553.rt7.342.el8_10 | ALSA-2024:2950 |
| AlmaLinux:9 | kernel-rt-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-tools | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-tools | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-tools-libs | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-tools-libs | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-tools-libs-devel | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-tools-libs-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-uki-virt | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-zfcpdump | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-zfcpdump | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-zfcpdump-core | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-zfcpdump-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-zfcpdump-devel | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-zfcpdump-devel | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-zfcpdump-devel-matched | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-zfcpdump-modules | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-zfcpdump-modules | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | kernel-zfcpdump-modules-core | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | kernel-zfcpdump-modules-extra | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | kernel-zfcpdump-modules-extra | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | libperf | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | perf | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | perf | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:8 | python3-perf | 4.18.0-553.el8_10 | ALSA-2024:3138 |
| AlmaLinux:9 | python3-perf | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | rtla | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| AlmaLinux:9 | rv | 5.14.0-427.13.1.el9_4 | ALSA-2024:2394 |
| Debian:13 | linux | 6.5.6-1 | DEBIAN-CVE-2023-52581 |
| Debian:14 | linux | 6.5.6-1 | DEBIAN-CVE-2023-52581 |
| Rocky Linux:8 | kernel | 0:4.18.0-553.el8_10 | RLSA-2024:3138 |
| Rocky Linux:8 | kernel-rt | 0:4.18.0-553.rt7.342.el8_10 | RLSA-2024:2950 |
| Ubuntu:22.04:LTS | linux | 5.15.0-94.104 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-allwinner-5.19 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-aws | 5.15.0-1053.58 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-aws-5.19 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-aws-6.2 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-aws-6.5 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-azure | 5.15.0-1056.64 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-azure-5.19 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-azure-6.2 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-azure-6.5 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-azure-fde | 5.15.0-1056.64.1 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-azure-fde-5.19 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-azure-fde-6.2 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-gcp | 5.15.0-1051.59 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-gcp-5.19 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-gcp-6.2 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-gcp-6.5 | 6.5.0-1013.13~22.04.1 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-gke | 5.15.0-1050.55 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-gkeop | 5.15.0-1036.42 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-hwe-5.19 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-hwe-6.2 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-hwe-6.5 | 6.5.0-17.17~22.04.1 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-ibm | 5.15.0-1046.49 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-intel-iotg | 5.15.0-1047.53 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-kvm | 5.15.0-1050.55 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-lowlatency | 5.15.0-94.104 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-5.19 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.2 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-lowlatency-hwe-6.5 | 6.5.0-17.17.1.1.1~22.04.1 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-nvidia | 5.15.0-1044.44 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-nvidia-6.2 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-nvidia-6.5 | 6.5.0-1014.14 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra | 5.15.0-1022.22 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-nvidia-tegra-igx | 5.15.0-1009.9 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-oem-5.17 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-oem-6.0 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-oem-6.1 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-oem-6.5 | 6.5.0-1014.15 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-oracle | 5.15.0-1051.57 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-oracle-6.5 | 6.5.0-1015.15~22.04.1 | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-raspi | 5.15.0-1046.49 | UBUNTU-CVE-2023-52581 |
| Ubuntu:24.04:LTS | linux-raspi | 6.7.0-1001.1 | UBUNTU-CVE-2023-52581 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-riscv-5.19 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-starfive-5.19 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-starfive-6.2 | no fix listed | UBUNTU-CVE-2023-52581 |
| Ubuntu:22.04:LTS | linux-xilinx-zynqmp | 5.15.0-1027.31 | UBUNTU-CVE-2023-52581 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 8da1b048f9a501d3d7d38c188ba09d7d0d5b8c27 – before 7cf055b43756b10aa2b851c927c940f5ed652125bbdb3b65aa91aa0a32b212f27780b28987f2d94f – before a995a68e8a3b48533e47c856865d109a1f1a9d01448be0774882f95a74fa5eb7519761152add601b – before 09c85f2d21ab6b5acba31a037985b13e8e6565b8d19e8bf3ea4114dd21fc35da21f398203d7f7df1 – before ef99506eaf1dc31feff1adfcfd68bc5535a22171ea3eb9f2192e4fc33b795673e56c97a21987f868 – before 7e5d732e6902eb6a37b35480796838a145ae5f075f68718b34a531a556f2f50300ead2862278da26 – before 4aea243b6853d06c1d160a9955b759189aa02b145f68718b34a531a556f2f50300ead2862278da26 – before cf5000a7787cbc10341091d37245a42c119d26c50624f190b5742a1527cd938295caa8dc5281d4cd |
| Linux | Linux | 6.5 |
References
- https://git.kernel.org/stable/c/7cf055b43756b10aa2b851c927c940f5ed652125
- https://git.kernel.org/stable/c/a995a68e8a3b48533e47c856865d109a1f1a9d01
- https://git.kernel.org/stable/c/09c85f2d21ab6b5acba31a037985b13e8e6565b8
- https://git.kernel.org/stable/c/ef99506eaf1dc31feff1adfcfd68bc5535a22171
- https://git.kernel.org/stable/c/7e5d732e6902eb6a37b35480796838a145ae5f07
- https://git.kernel.org/stable/c/4aea243b6853d06c1d160a9955b759189aa02b14
- https://git.kernel.org/stable/c/cf5000a7787cbc10341091d37245a42c119d26c5