SECUFOCUSNOW
Home›CVE index›CVE-2023-53333
Review reviewHigh

CVE-2023-53333

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one Eric Dumazet says: nf_conntrack_dccp_packet() has an unique: dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); And nothing more is 'pulled' from the packet, depending on the content. dh->dccph_doff, and/or dh->dccph_x ...) So dccp_ack_seq() is happily reading stuff past the _dh buffer. BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 [..] Fix...

CVSS
7.1
EPSS
-
- percentile
CISA KEV
Not listed
Published
2025.09.17
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.1

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one Eric Dumazet says: nf_conntrack_dccp_packet() has an unique: dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); And nothing more is 'pulled' from the packet, depending on the content. dh->dccph_doff, and/or dh->dccph_x ...) So dccp_ack_seq() is happily reading stuff past the _dh buffer. BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 [..] Fix...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 2bc780499aa33311ec0f3e42624dfaa7be0ade5e < 337fdce450637ea663bc816edc2ba81e5cdad02e, >= 2bc780499aa33311ec0f3e42624dfaa7be0ade5e < 9bdcda7abaf22f6453e5b5efb7eb4e524095d5d8, >= 2bc780499aa33311ec0f3e42624dfaa7be0ade5e < c052797ac36813419ad3bfa54cb8615db4b41f15, >= 2bc780499aa33311ec0f3e42624dfaa7be0ade5e < 5c618daa5038712c4a4ef8923905a2ea1b8836a1, >= 2bc780499aa33311ec0f3e42624dfaa7be0ade5e < 26bd1f210d3783a691052c51d76bb8a8bbd24c67, >= 2bc780499aa33311ec0f3e42624dfaa7be0ade5e < 8c0980493beed3a80d6329c44ab293dc8c032927, >= 2bc780499aa33311ec0f3e42624dfaa7be0ade5e < ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30, >= 2.6.26, >= 2.6.26 < 5.4.251, >= 5.5 < 5.10.188, >= 5.11 < 5.15.121, >= 5.16 < 6.1.39, >= 6.2 < 6.3.13, >= 6.4 < 6.4.4
Fixed versions
5.4.251, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE
CWE-125