CVE-2023-32233

Name: CVE-2023-32233
Creator: NVD / NIST
Published: 2023-05-08T20:15:20.267+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.8/10EPSS 12.97%

Last modified Jun 17, 2026

CVE-2023-32233 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. EPSS estimates a 12.97% chance of exploitation in the next 30 days.

Description

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous sets are mishandled.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

12.97%

95.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Linux	Linux Kernel	>= 3.13, < 4.14.315
Linux	Linux Kernel	>= 4.15, < 4.19.283
Linux	Linux Kernel	>= 4.20, < 5.4.243
Linux	Linux Kernel	>= 5.5, < 5.10.180
Linux	Linux Kernel	>= 5.11, < 5.15.111
Linux	Linux Kernel	>= 5.16, < 6.1.28
Linux	Linux Kernel	>= 6.2, < 6.2.15
Linux	Linux Kernel	>= 6.3, < 6.3.2
Redhat	Enterprise Linux	7.0
Redhat	Enterprise Linux	8.0
Redhat	Enterprise Linux	9.0
Netapp	Hci Baseboard Management Controller	h300s
Netapp	Hci Baseboard Management Controller	h410c
Netapp	Hci Baseboard Management Controller	h410s
Netapp	Hci Baseboard Management Controller	h500s
Netapp	Hci Baseboard Management Controller	h700s

References

http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.htmlPatch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/05/15/5Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2196105Issue Tracking, Mitigation, Third Party Advisory
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c1592a89942e9678f7d9c8030efa777c0d57edabMailing List, Patch
https://github.com/torvalds/linux/commit/c1592a89942e9678f7d9c8030efa777c0d57edabPatch
https://lists.debian.org/debian-lts-announce/2023/06/msg00008.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/07/msg00030.htmlMailing List, Third Party Advisory
https://news.ycombinator.com/item?id=35879660Issue Tracking
https://security.netapp.com/advisory/ntap-20230616-0002/Mailing List, Third Party Advisory
https://www.debian.org/security/2023/dsa-5402Mailing List, Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/05/08/4Mailing List, Patch, Third Party Advisory
http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.htmlPatch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/05/15/5Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2196105Issue Tracking, Mitigation, Third Party Advisory
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c1592a89942e9678f7d9c8030efa777c0d57edabMailing List, Patch
https://github.com/torvalds/linux/commit/c1592a89942e9678f7d9c8030efa777c0d57edabPatch
https://lists.debian.org/debian-lts-announce/2023/06/msg00008.htmlThird Party Advisory
https://lists.debian.org/debian-lts-announce/2023/07/msg00030.htmlMailing List, Third Party Advisory
https://news.ycombinator.com/item?id=35879660Issue Tracking
https://security.netapp.com/advisory/ntap-20230616-0002/Mailing List, Third Party Advisory
https://www.debian.org/security/2023/dsa-5402Mailing List, Third Party Advisory
https://www.openwall.com/lists/oss-security/2023/05/08/4Mailing List, Patch, Third Party Advisory

Timeline

Published: May 8, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-32233?

How severe is CVE-2023-32233?

CVE-2023-32233 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 12.97% probability of exploitation in the next 30 days.

How do I fix CVE-2023-32233?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-32233?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST