Security readout for executives and security teams
Plain-English summary
This is a Linux kernel availability flaw in netfilter nftables set handling. A highly privileged local user could trigger a kernel crash or denial of service through a transaction and garbage-collection timing bug. It is operationally important for shared Linux hosts, appliances, and systems where privileged shell or container escape risk exists.
Executive priority
Prioritize normal kernel maintenance, with faster action for shared hosts, internet-facing platforms with many administrators, and NetApp environments. Business risk is mainly outage from a privileged local actor, not data theft or remote compromise according to the supplied evidence.
Technical view
The issue is in netfilter nft_set_rbtree. Newly added transaction elements can expire before the transaction finishes; synchronous garbage collection could then let the commit path walk a released object. Kernel stable fixes skip synchronous GC for new elements in the current transaction, leaving later asynchronous GC to collect them.
Likely exposure
Exposure is limited to Linux systems using affected kernel builds around the cited 6.5 and 6.6 lines. The CVSS vector requires local access and high privileges, with availability impact only. NetApp also published an advisory, so appliances or storage platforms using affected Linux kernels should be checked.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The attack model is local, low complexity, high privilege, no user interaction, and denial of service. Treat this as a patch-management and privileged-access hardening issue rather than a remotely exploitable emergency.
Researcher notes
The key condition is transaction-scoped rbtree set element lifetime versus synchronous garbage collection. The fix changes GC behavior for elements created in the active transaction. Public evidence supplied here does not include proof-of-concept details, exploit reports, or affected distribution package names.
Mitigation direction
- Update affected Linux kernels to vendor-supported builds containing the stable netfilter fixes.
- Check Linux distribution security advisories for the backported fix status.
- Review NetApp advisory NTAP-20240828-0003 for affected NetApp products and fixes.
- Limit shell, sudo, nftables, and container-admin access to trusted users.
- Monitor kernel crash reports and denial-of-service symptoms on exposed multi-user systems.
Validation and detection
- Inventory Linux kernel versions on servers, appliances, and containers with host privileges.
- Compare installed kernel changelogs against the referenced stable fix commits.
- Confirm whether systems use nftables or netfilter features in production.
- Check NetApp assets against the published NetApp advisory.
- Verify CISA KEV remains negative before claiming active exploitation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-273: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-52433 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H0.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.4MediumVector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9db9feb841f7449772f9393c16b9ef4536d8c127CVE reference
- https://git.kernel.org/stable/c/03caf75da1059f0460666c826e9f50e13dfd0017CVE reference
- https://git.kernel.org/stable/c/c323ed65f66e5387ee0a73452118d49f1dae81b8CVE reference
- https://git.kernel.org/stable/c/9af7dfb3c9d7985172a240f85e684c5cd33e29ceCVE reference
- https://git.kernel.org/stable/c/9a8c544158f68f656d1734eb5ba00c4f817b76b1CVE reference
- https://git.kernel.org/stable/c/e3213ff99a355cda811b41e8dbb3472d13167a3aCVE reference
- https://git.kernel.org/stable/c/2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4CVE reference
- https://security.netapp.com/advisory/ntap-20240828-0003/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Check for Dropped Privileges
Improper Check for Dropped Privileges represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.