CVE-2023-52433

What it actually does

Use-after-free in netfilter nft_set_rbtree when sync GC runs on newly added transaction elements that expire before commit, allowing access to a freed object during the commit walk.

Why it matters to the business

Kernel crashes or potential local privilege escalation on Linux systems that use nftables, affecting network filtering availability and host security; low observed exploitation risk reduces immediate urgency.

How an attack unfolds

An attacker with local access crafts nftables rules that insert elements into an rbtree set inside a transaction; elements expire before the transaction commits, causing the sync GC path to dereference a released object.

How to fix it

Upgrade the Linux kernel to a version containing commit 9db9feb841f7449772f9393c16b9ef4536d8c127; apply the corresponding stable or distribution kernel update that backports the fix.

How to confirm the fix worked

Confirm the running kernel contains commit 9db9feb841f7449772f9393c16b9ef4536d8c127 or an equivalent backport; exercise nftables set insertion with expiration timers and verify no use-after-free occurs during commit.

Typical attack path

1. Obtain local shell or code execution on a target Linux host
2. Load or modify nftables configuration to create sets with short-lived elements inside a transaction
3. Trigger transaction commit while the elements have expired
4. Trigger the use-after-free during the sync GC walk

How to detect it

Inspect kernel logs and dmesg for oops/panic messages referencing nft_set_rbtree, netfilter, or use-after-free during nftables commit operations; correlate with recent nftables configuration changes.

What your security team should do

• Prioritize kernel updates on systems that actively use nftables
• Audit nftables configurations for complex transactional sets with expiration
• Monitor kernel logs for netfilter-related oops or panics until patches are deployed