CVE-2023-52925

What it actually does

The flaw is a logic error in nftables set handling (particularly pipapo) where expired duplicate elements are not properly skipped during insert, activate, remove, and get operations, violating expected duplicate-check semantics and causing incorrect set state.

Why it matters to the business

Linux systems relying on nftables for firewalling or packet classification may experience unexpected rule behavior or test failures, increasing operational risk for network security controls; low urgency given absence from KEV and flat low EPSS.

How an attack unfolds

An attacker with ability to manage nftables sets could trigger duplicate-element insertion paths involving timed-out entries to produce inconsistent set contents, potentially bypassing intended filtering; related Linux kernel privilege-escalation activity by multiple threat actors highlights the broader attack surface but this specific issue centers on set correctness rather than direct code execution.

How to fix it

Apply the kernel patch that resolves the expired-element check in pipapo_get and related callbacks, present in commit 891ca5dfe3b718b441fc786014a7ba8f517da188; rebuild and reboot to the fixed kernel version.

How to confirm the fix worked

Confirm the running kernel contains commit 891ca5dfe3b718b441fc786014a7ba8f517da188 or later equivalent stable release; re-run the nftables selftest 0044interval_overlap_0 and verify expected duplicate handling.

Typical attack path

1. Obtain capability to add or modify nftables sets (local user or compromised process)
2. Create interval sets containing elements that expire
3. Issue duplicate insert operations timed to hit the expired-element path
4. Observe or abuse resulting inconsistent set membership to alter packet processing

How to detect it

Inspect system logs for nftables set operation failures or selftest mismatches around interval sets; correlate with process activity that adds or deletes nftables elements.

What your security team should do

• Patch all affected Linux kernel packages to the fixed commit within normal maintenance windows
• Review nftables configurations for reliance on interval sets with expiration
• Monitor upstream stable kernel updates for additional nftables fixes
• Limit unprivileged nftables access where feasible