CVE-2023-52927
Published: 14 March 2025
Summary
CVE-2023-52927 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2023-52927 is a vulnerability in the Linux kernel's netfilter subsystem, specifically affecting the nf_ct_find_expectation() function called by nf_conntrack_in(). This function currently removes the expectation (exp) entry from the hash table, but in certain scenarios—such as those involving Open vSwitch (OVS) and TC conntrack—the expectation should remain if the created connection tracking (ct) entry is not confirmed. Classified as CWE-416 (Use After Free), it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-03-14.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction. Successful exploitation enables high impacts on confidentiality, integrity, and availability, potentially through use-after-free conditions leading to arbitrary code execution, data corruption, or system crashes within the kernel context.
Mitigation is available through patches applied to Linux kernel stable branches, including commits 3fa58a6fbd1e9e5682d09cdafb08fba004cb12ec and 4914109a8e1e494c6aa9852f9e84ec77a5fc643f at git.kernel.org/stable. Debian LTS has issued announcements for affected systems, as noted in their May 2025 advisory. Further analysis is provided in the referenced blog post at seadragnol.github.io/posts/CVE-2023-52927/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-59682
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenario, we expect the exp not…
more
to be removed when the created ct will not be confirmed, like in OVS and TC conntrack in the following patches. This patch allows exp not to be removed by setting IPS_CONFIRMED in the status of the tmpl.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local use-after-free in Linux kernel netfilter/conntrack allows arbitrary code execution in kernel context by low-privileged attacker, directly enabling privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, testing, and installation of patches that directly resolve the Use After Free vulnerability in the Linux kernel's nf_ct_find_expectation function.
Implements kernel memory protection safeguards such as KASLR, SMEP, and SMAP that mitigate exploitation of the Use After Free condition in netfilter conntrack.
Vulnerability scanning identifies the presence of CVE-2023-52927 in deployed Linux kernels by checking versions against known vulnerabilities, enabling remediation.