CVE-2023-53333
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-12-10
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 2.6.26 (inc) to 5.4.251 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.188 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.121 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.39 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.3.13 (exc) |
| linux | linux_kernel | From 6.4 (inc) to 6.4.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's netfilter conntrack for DCCP involves improper handling of packet headers. Specifically, the code only copied the basic DCCP header to a stack buffer but then read beyond this buffer when accessing additional fields like sequence numbers. This caused a stack-out-of-bounds read, which is a memory safety issue. The fix involved increasing the stack buffer size to include all necessary header parts and validating packets more thoroughly.
How can this vulnerability impact me? :
The vulnerability can lead to a stack-out-of-bounds read in the Linux kernel, which may cause kernel crashes or undefined behavior. This can potentially be exploited to compromise system stability or security, such as causing denial of service or enabling further attacks on the kernel.
What immediate steps should I take to mitigate this vulnerability?
Apply the patch or update the Linux kernel to a version where the netfilter conntrack dccp vulnerability has been fixed. Since the issue involves stack buffer overflow in nf_conntrack_dccp_packet, updating the kernel to include the fix that increases the stack buffer size and validates packet headers properly is necessary. Additionally, consider disabling dccp conntrack support if possible, as it is planned to be removed.