VYPR
← All advisories
High severity7.8NVD Advisory· Published Mar 14, 2025· Updated May 12, 2026

CVE-2023-52927

CVE-2023-52927

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: allow exp not to be removed in nf_ct_find_expectation

Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not to be removed when the created ct will not be confirmed, like in OVS and TC conntrack in the following patches.

This patch allows exp not to be removed by setting IPS_CONFIRMED in the status of the tmpl.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A use-after-free in Linux kernel's netfilter conntrack allows local privilege escalation when a template connection is prematurely freed.

Vulnerability

CVE-2023-52927 is a use-after-free (UAF) vulnerability in the Linux kernel's netfilter connection tracking (nf_conntrack) subsystem. The root cause is an incorrect handling of expectations in nf_ct_find_expectation(). Normally, when a conntrack expectation is found, it is removed from the hash table. However, for unconfirmed connections (e.g., in OVS or TC conntrack), the expectation should remain. The patch allows the expectation not to be removed by checking the IPS_CONFIRMED flag on the template. Failure to do so can lead to a UAF when the template nf_conn is freed but still referenced [1][2].

Exploitation

An attacker can exploit this vulnerability by crafting a sequence of netfilter operations to cause a template nf_conn to be freed while still in use. The exploit requires local access and the ability to create netfilter rules (CAP_NET_ADMIN). By triggering the UAF, an attacker can gain a primitive to corrupt kernel memory, as demonstrated by a proof-of-concept (PoC) that achieves arbitrary read/write and eventually RIP control [2]. The attack vector involves manipulating nf_nat and nf_tables to leak heap addresses and overwrite function pointers.

Impact

Successful exploitation allows a local unprivileged attacker to escalate privileges to root, potentially leading to full system compromise. The vulnerability is rated High with a CVSS v3 score of 7.8 [1].

Mitigation

The fix is included in Linux kernel stable releases. Administrators should apply the latest kernel updates from their distribution. Affected products include the Siemens SIMATIC S7-1500 CPU family (and related ET 200 CPUs and SIPLUS variants) which rely on the Linux kernel and should be updated per vendor guidance [1]. There is no workaround; patching is required.

References
  1. SSA-082556
  2. CVE-2023-52927 - Turning a Forgotten Syzkaller Report into kCTF Exploit

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

199

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

5

News mentions

0

No linked articles in our index yet.