GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-52628 (GCVE-0-2023-52628)

Vulnerability from cvelistv5 – Published: 2024-03-28 07:33 – Updated: 2026-08-05 09:10
VLAI
Title
netfilter: nftables: exthdr: fix 4-byte stack OOB write
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv->len is a multiple of 4, then dst[len / 4] can write past the destination array which leads to stack corruption. This construct is necessary to clean the remainder of the register in case ->len is NOT a multiple of the register size, so make it conditional just like nft_payload.c does. The bug was added in 4.1 cycle and then copied/inherited when tcp/sctp and ip option support was added. Bug reported by Zero Day Initiative project (ZDI-CAN-21950, ZDI-CAN-21951, ZDI-CAN-21961).
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-03-28 18:07 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 49499c3e6e18b7677a63316f3ff54a16533dc28f , < 28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a (git)
Affected: 49499c3e6e18b7677a63316f3ff54a16533dc28f , < cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb (git)
Affected: 49499c3e6e18b7677a63316f3ff54a16533dc28f , < a7d86a77c33ba1c357a7504341172cc1507f0698 (git)
Affected: 49499c3e6e18b7677a63316f3ff54a16533dc28f , < 1ad7b189cc1411048434e8595ffcbe7873b71082 (git)
Affected: 49499c3e6e18b7677a63316f3ff54a16533dc28f , < d9ebfc0f21377690837ebbd119e679243e0099cc (git)
Affected: 49499c3e6e18b7677a63316f3ff54a16533dc28f , < c8f292322ff16b9a2272a67de396c09a50e09dce (git)
Affected: 49499c3e6e18b7677a63316f3ff54a16533dc28f , < fd94d9dadee58e09b49075240fe83423eb1dcd36 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.1
Unaffected: 0 , < 4.1 (semver)
Unaffected: 4.19.316 , ≤ 4.19.* (semver)
Unaffected: 5.4.279 , ≤ 5.4.* (semver)
Unaffected: 5.10.198 , ≤ 5.10.* (semver)
Unaffected: 5.15.132 , ≤ 5.15.* (semver)
Unaffected: 6.1.54 , ≤ 6.1.* (semver)
Unaffected: 6.5.4 , ≤ 6.5.* (semver)
Unaffected: 6.6 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52628",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-28T18:07:47.232629Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:24:11.510Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-04T17:14:07.549Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a7d86a77c33ba1c357a7504341172cc1507f0698"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1ad7b189cc1411048434e8595ffcbe7873b71082"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d9ebfc0f21377690837ebbd119e679243e0099cc"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c8f292322ff16b9a2272a67de396c09a50e09dce"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/fd94d9dadee58e09b49075240fe83423eb1dcd36"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_exthdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a",
              "status": "affected",
              "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
              "versionType": "git"
            },
            {
              "lessThan": "cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb",
              "status": "affected",
              "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
              "versionType": "git"
            },
            {
              "lessThan": "a7d86a77c33ba1c357a7504341172cc1507f0698",
              "status": "affected",
              "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
              "versionType": "git"
            },
            {
              "lessThan": "1ad7b189cc1411048434e8595ffcbe7873b71082",
              "status": "affected",
              "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
              "versionType": "git"
            },
            {
              "lessThan": "d9ebfc0f21377690837ebbd119e679243e0099cc",
              "status": "affected",
              "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
              "versionType": "git"
            },
            {
              "lessThan": "c8f292322ff16b9a2272a67de396c09a50e09dce",
              "status": "affected",
              "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
              "versionType": "git"
            },
            {
              "lessThan": "fd94d9dadee58e09b49075240fe83423eb1dcd36",
              "status": "affected",
              "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_exthdr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "lessThan": "4.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.316",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.279",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.316",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.279",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.198",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.132",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.54",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.4",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nftables: exthdr: fix 4-byte stack OOB write\n\nIf priv-\u003elen is a multiple of 4, then dst[len / 4] can write past\nthe destination array which leads to stack corruption.\n\nThis construct is necessary to clean the remainder of the register\nin case -\u003elen is NOT a multiple of the register size, so make it\nconditional just like nft_payload.c does.\n\nThe bug was added in 4.1 cycle and then copied/inherited when\ntcp/sctp and ip option support was added.\n\nBug reported by Zero Day Initiative project (ZDI-CAN-21950,\nZDI-CAN-21951, ZDI-CAN-21961)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable nft_exthdr eval paths are reached only after an attacker installs a crafted nftables rule over netlink and then triggers packet evaluation in that netns; nftables/netlink is a local attack surface, not remote packet parsing.\nAC:L - The attacker fully controls dreg/len via rule creation and can reliably force len to be a multiple of 4 that fills regs to the end, then trigger evaluation with a crafted local packet; no race or uncontrolled condition is required.\nPR:L - Rule installation requires CAP_NET_ADMIN checked via netlink_net_capable against the network namespace user_ns, which an unprivileged process obtains with user and network namespaces (unshare -Urn).\nUI:N - No victim action is needed; the attacker creates the malicious rule and sends packets in their own netns to hit the exthdr expression.\nS:U - Impact is kernel memory corruption / potential privilege escalation within the same host kernel authority; this is not a VM, IOMMU, or other cross-boundary escape.\nC:H - A kernel stack out-of-bounds write corrupts adjacent stack state and, per memory-corruption guidance and vendor notes of potential information disclosure, can be leveraged toward confidentiality impact; when uncertain the higher severity applies.\nI:H - This is a confirmed stack out-of-bounds write past struct nft_regs (into stackptr/jumpstack territory), and OOB writes are scored High for integrity due to exploitable control-flow / memory-corruption potential.\nA:H - Stack corruption adjacent to nft_do_chain locals can cause kernel oops/panic or broken jump-stack handling, yielding a high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:10:47.591Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7d86a77c33ba1c357a7504341172cc1507f0698"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ad7b189cc1411048434e8595ffcbe7873b71082"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9ebfc0f21377690837ebbd119e679243e0099cc"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8f292322ff16b9a2272a67de396c09a50e09dce"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd94d9dadee58e09b49075240fe83423eb1dcd36"
        }
      ],
      "title": "netfilter: nftables: exthdr: fix 4-byte stack OOB write",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52628",
    "datePublished": "2024-03-28T07:33:46.217Z",
    "dateReserved": "2024-03-06T09:52:12.091Z",
    "dateUpdated": "2026-08-05T09:10:47.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52628",
      "date": "2026-09-20",
      "epss": "0.00677",
      "percentile": "0.50796"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/nft_exthdr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a",
                    "status": "affected",
                    "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb",
                    "status": "affected",
                    "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a7d86a77c33ba1c357a7504341172cc1507f0698",
                    "status": "affected",
                    "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1ad7b189cc1411048434e8595ffcbe7873b71082",
                    "status": "affected",
                    "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d9ebfc0f21377690837ebbd119e679243e0099cc",
                    "status": "affected",
                    "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c8f292322ff16b9a2272a67de396c09a50e09dce",
                    "status": "affected",
                    "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fd94d9dadee58e09b49075240fe83423eb1dcd36",
                    "status": "affected",
                    "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/nft_exthdr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.1"
                  },
                  {
                    "lessThan": "4.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.316",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.279",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.198",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.132",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.5.*",
                    "status": "unaffected",
                    "version": "6.5.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.6",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BD3CB157-23C2-46B5-AF99-3A3162A9588E",
                    "versionEndExcluding": "5.10.198",
                    "versionStartIncluding": "4.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5913891D-409A-4EEC-9231-F2EF5A493BC7",
                    "versionEndExcluding": "5.15.132",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7353B9B4-AFFC-45DE-840E-1A7D2B00E7AD",
                    "versionEndExcluding": "6.1.54",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CA8C8B88-AF36-445D-A228-AD78F3615373",
                    "versionEndExcluding": "6.5.4",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nftables: exthdr: fix 4-byte stack OOB write\n\nIf priv-\u003elen is a multiple of 4, then dst[len / 4] can write past\nthe destination array which leads to stack corruption.\n\nThis construct is necessary to clean the remainder of the register\nin case -\u003elen is NOT a multiple of the register size, so make it\nconditional just like nft_payload.c does.\n\nThe bug was added in 4.1 cycle and then copied/inherited when\ntcp/sctp and ip option support was added.\n\nBug reported by Zero Day Initiative project (ZDI-CAN-21950,\nZDI-CAN-21951, ZDI-CAN-21961)."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nftables: exthdr: corrige escritura OOB de pila de 4 bytes Si priv-\u0026gt;len es m\u00faltiplo de 4, entonces dst[len / 4] puede escribir m\u00e1s all\u00e1 de la matriz de destino que conduce a la corrupci\u00f3n de la pila. Esta construcci\u00f3n es necesaria para limpiar el resto del registro en caso de que -\u0026gt;len NO sea un m\u00faltiplo del tama\u00f1o del registro, as\u00ed que h\u00e1galo condicional tal como lo hace nft_payload.c. El error se agreg\u00f3 en el ciclo 4.1 y luego se copi\u00f3/hered\u00f3 cuando se agreg\u00f3 la compatibilidad con las opciones tcp/sctp e ip. Error informado por el proyecto Zero Day Initiative (ZDI-CAN-21950, ZDI-CAN-21951, ZDI-CAN-21961)."
          }
        ],
        "id": "CVE-2023-52628",
        "lastModified": "2026-08-04T10:18:35.663",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-52628",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-28T18:07:47.232629Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-03-28T08:15:25.980",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1ad7b189cc1411048434e8595ffcbe7873b71082"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a7d86a77c33ba1c357a7504341172cc1507f0698"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c8f292322ff16b9a2272a67de396c09a50e09dce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d9ebfc0f21377690837ebbd119e679243e0099cc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fd94d9dadee58e09b49075240fe83423eb1dcd36"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1ad7b189cc1411048434e8595ffcbe7873b71082"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/a7d86a77c33ba1c357a7504341172cc1507f0698"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c8f292322ff16b9a2272a67de396c09a50e09dce"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d9ebfc0f21377690837ebbd119e679243e0099cc"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fd94d9dadee58e09b49075240fe83423eb1dcd36"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:25:01+00:00",
      "cve": "CVE-2023-52628",
      "id": "CVE-2023-52628",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "709",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nftables: exthdr: fix 4-byte stack OOB write",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52628.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-04T17:14:07.549Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/a7d86a77c33ba1c357a7504341172cc1507f0698"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/1ad7b189cc1411048434e8595ffcbe7873b71082"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/d9ebfc0f21377690837ebbd119e679243e0099cc"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/c8f292322ff16b9a2272a67de396c09a50e09dce"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/fd94d9dadee58e09b49075240fe83423eb1dcd36"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-52628",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-03-28T18:07:47.232629Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-23T19:01:19.824Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "net/netfilter/nft_exthdr.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a",
                  "status": "affected",
                  "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
                  "versionType": "git"
                },
                {
                  "lessThan": "cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb",
                  "status": "affected",
                  "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
                  "versionType": "git"
                },
                {
                  "lessThan": "a7d86a77c33ba1c357a7504341172cc1507f0698",
                  "status": "affected",
                  "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
                  "versionType": "git"
                },
                {
                  "lessThan": "1ad7b189cc1411048434e8595ffcbe7873b71082",
                  "status": "affected",
                  "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
                  "versionType": "git"
                },
                {
                  "lessThan": "d9ebfc0f21377690837ebbd119e679243e0099cc",
                  "status": "affected",
                  "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
                  "versionType": "git"
                },
                {
                  "lessThan": "c8f292322ff16b9a2272a67de396c09a50e09dce",
                  "status": "affected",
                  "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
                  "versionType": "git"
                },
                {
                  "lessThan": "fd94d9dadee58e09b49075240fe83423eb1dcd36",
                  "status": "affected",
                  "version": "49499c3e6e18b7677a63316f3ff54a16533dc28f",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "net/netfilter/nft_exthdr.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.1"
                },
                {
                  "lessThan": "4.1",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.316",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.279",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.198",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.132",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.54",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.5.*",
                  "status": "unaffected",
                  "version": "6.5.4",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.6",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.316",
                      "versionStartIncluding": "4.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.279",
                      "versionStartIncluding": "4.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.198",
                      "versionStartIncluding": "4.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.132",
                      "versionStartIncluding": "4.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.54",
                      "versionStartIncluding": "4.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.5.4",
                      "versionStartIncluding": "4.1",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6",
                      "versionStartIncluding": "4.1",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nftables: exthdr: fix 4-byte stack OOB write\n\nIf priv-\u003elen is a multiple of 4, then dst[len / 4] can write past\nthe destination array which leads to stack corruption.\n\nThis construct is necessary to clean the remainder of the register\nin case -\u003elen is NOT a multiple of the register size, so make it\nconditional just like nft_payload.c does.\n\nThe bug was added in 4.1 cycle and then copied/inherited when\ntcp/sctp and ip option support was added.\n\nBug reported by Zero Day Initiative project (ZDI-CAN-21950,\nZDI-CAN-21951, ZDI-CAN-21961)."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerable nft_exthdr eval paths are reached only after an attacker installs a crafted nftables rule over netlink and then triggers packet evaluation in that netns; nftables/netlink is a local attack surface, not remote packet parsing.\nAC:L - The attacker fully controls dreg/len via rule creation and can reliably force len to be a multiple of 4 that fills regs to the end, then trigger evaluation with a crafted local packet; no race or uncontrolled condition is required.\nPR:L - Rule installation requires CAP_NET_ADMIN checked via netlink_net_capable against the network namespace user_ns, which an unprivileged process obtains with user and network namespaces (unshare -Urn).\nUI:N - No victim action is needed; the attacker creates the malicious rule and sends packets in their own netns to hit the exthdr expression.\nS:U - Impact is kernel memory corruption / potential privilege escalation within the same host kernel authority; this is not a VM, IOMMU, or other cross-boundary escape.\nC:H - A kernel stack out-of-bounds write corrupts adjacent stack state and, per memory-corruption guidance and vendor notes of potential information disclosure, can be leveraged toward confidentiality impact; when uncertain the higher severity applies.\nI:H - This is a confirmed stack out-of-bounds write past struct nft_regs (into stackptr/jumpstack territory), and OOB writes are scored High for integrity due to exploitable control-flow / memory-corruption potential.\nA:H - Stack corruption adjacent to nft_do_chain locals can cause kernel oops/panic or broken jump-stack handling, yielding a high availability impact."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T09:10:47.591Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a"
            },
            {
              "url": "https://git.kernel.org/stable/c/cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb"
            },
            {
              "url": "https://git.kernel.org/stable/c/a7d86a77c33ba1c357a7504341172cc1507f0698"
            },
            {
              "url": "https://git.kernel.org/stable/c/1ad7b189cc1411048434e8595ffcbe7873b71082"
            },
            {
              "url": "https://git.kernel.org/stable/c/d9ebfc0f21377690837ebbd119e679243e0099cc"
            },
            {
              "url": "https://git.kernel.org/stable/c/c8f292322ff16b9a2272a67de396c09a50e09dce"
            },
            {
              "url": "https://git.kernel.org/stable/c/fd94d9dadee58e09b49075240fe83423eb1dcd36"
            }
          ],
          "title": "netfilter: nftables: exthdr: fix 4-byte stack OOB write",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2023-52628",
        "datePublished": "2024-03-28T07:33:46.217Z",
        "dateReserved": "2024-03-06T09:52:12.091Z",
        "dateUpdated": "2026-08-05T09:10:47.591Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.