Cloudanix VulnDB

CVE-2023-53635

Medium · 5.5

CVSS

5.5

EPSS

0.4%

Published

Oct 7, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux connection tracking can make network timeouts behave incorrectly, which might interrupt some network services until fixed.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect timeout calculation for unconfirmed conntrack entries due to double application of nfct_time_stamp when setting via ctnetlink_change_timeout and getting via ctnetlink_dump_timeout, leading to wrong interval or timestamp values after IPS_CONFIRMED flag.

Why it matters to the business

May cause unreliable connection tracking behavior on Linux systems, resulting in premature or delayed timeout of network connections and potential service disruption for network-heavy workloads.

How an attack unfolds

An attacker with local access triggers conntrack creation or manipulation through netfilter queue or ctnetlink, causing incorrect timeout values that disrupt normal connection state handling in the kernel.

How to fix it

Apply the upstream kernel fix that separates timeout setting in __nf_ct_set_timeout and getting in ctnetlink_dump_timeout; ensure IPS_CONFIRMED flag is set before timeout configuration. For listed RedCloth packages update to version 4.3.0.

How to confirm the fix worked

Verify kernel source contains the corrected __nf_ct_set_timeout and ctnetlink_dump_timeout logic; test conntrack creation via ctnetlink and confirm timeout values are accurate post-confirmation.

Typical attack path

  1. Obtain local access to a vulnerable Linux system
  2. Interact with netfilter or ctnetlink interfaces to create or modify unconfirmed conntrack entries
  3. Trigger double timestamp adjustment leading to invalid timeout
  4. Observe or induce abnormal connection timeout behavior

How to detect it

Review kernel logs for conntrack timeout errors, inspect netlink queue activity, and check for unusual conntrack entry lifetimes via conntrack tools.

What your security team should do

  • Prioritize kernel updates on systems using netfilter and nfnetlink_queue
  • Monitor for conntrack-related anomalies in network logs
  • Apply RedCloth 4.3.0 where applicable despite description mismatch

The record

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: fix wrong ct->timeout value (struct nf_conn)->timeout is an interval before the conntrack confirmed. After confirmed, it becomes a timestamp. It is observed that timeout of an unconfirmed conntrack: - Set by calling ctnetlink_change_timeout(). As a result, `nfct_time_stamp` was wrongly added to `ct->timeout` twice. - Get by calling ctnetlink_dump_timeout(). As a result, `nfct_time_stamp` was wrongly subtracted. Call Trace: <TASK> dump_stack_lvl ctnetlink_dump_timeout __ctnetlink_glue_build ctnetlink_glue_build __nfqnl_enqueue_packet nf_queue nf_hook_slow ip_mc_output ? __pfx_ip_finish_output ip_send_skb ? __pfx_dst_output udp_send_skb udp_sendmsg ? __pfx_ip_generic_getfrag sock_sendmsg Separate the 2 cases in: - Setting `ct->timeout` in __nf_ct_set_timeout(). - Getting `ct->timeout` in ctnetlink_dump_timeout(). Pablo appends: Update ctnetlink to set up the timeout _after_ the IPS_CONFIRMED flag is set on, otherwise conntrack creation via ctnetlink breaks. Note that the problem described in this patch occurs since the introduction of the nfnetlink_queue conntrack support, select a sufficiently old Fixes: tag for -stable kernel to pick up this fix.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 4.4.0 6.1.28

Related vulnerabilities