CVE-2023-52923

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: adapt set backend to use GC transaction API

Use the GC transaction API to replace the old and buggy gc API and the busy mark approach.

No set elements are removed from async garbage collection anymore, instead the _DEAD bit is set on so the set element is not visible from lookup path anymore. Async GC enqueues transaction work that might be aborted and retried later.

rbtree and pipapo set backends does not set on the _DEAD bit from the sync GC path since this runs in control plane path where mutex is held. In this case, set elements are deactivated, removed and then released via RCU callback, sync GC never fails.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation is restricted to local attackers with the capability to manage network tables, limiting the blast radius primarily to a denial of service. By default on Red Hat Enterprise Linux, manipulating nf_tables requires elevated privileges (CAP_NET_ADMIN), though unprivileged users could potentially reach the subsystem if user namespaces are enabled. Because the issue cannot be exploited remotely and does not directly result in confidentiality loss or code execution under typical configurations, it does not warrant an Important rating.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.