VYPR
← All advisories
Low severity2.5NVD Advisory· Published Mar 21, 2024· Updated May 12, 2026

CVE-2023-52620

CVE-2023-52620

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: disallow timeout for anonymous sets

Never used from userspace, disallow these parameters.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A low-severity vulnerability in the Linux kernel's netfilter nf_tables allows timeout parameters for anonymous sets, which were never intended for userspace use, potentially leading to unexpected behavior.

Vulnerability

Overview

CVE-2023-52620 is a low-severity issue in the Linux kernel's netfilter subsystem, specifically in the nf_tables module. The vulnerability arises because the kernel accepted timeout parameters for anonymous sets, even though these sets are never used from userspace. This oversight could allow the configuration of timeout values that have no practical effect, potentially leading to resource mismanagement or unexpected behavior.

Exploitation and

Attack Surface

Exploitation of this vulnerability requires the ability to create or modify nftables rules, which typically demands root privileges or CAP_NET_ADMIN. An attacker with such access could set timeout parameters on anonymous sets, but since these sets are not exposed to userspace, the impact is limited. The attack surface is narrow, as it depends on local access and specific kernel configuration.

Impact

The primary impact is the potential for resource exhaustion or misconfiguration within the kernel's netfilter framework. However, due to the low severity (CVSS 2.5) and the fact that anonymous sets are not user-visible, the practical risk is minimal. The vulnerability is more of a hardening issue than an exploitable security flaw.

Mitigation

The fix, committed to the Linux kernel, disallows timeout parameters for anonymous sets, ensuring they are ignored. Users should apply kernel updates from their distribution. The vulnerability is also listed in a Siemens advisory [1] affecting the SIMATIC S7-1500 TM MFP GNU/Linux subsystem, where appropriate patches should be applied.

References
  1. SSA-265688

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

138

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.