LiveActive security incident?Get immediate response
CVE Record

CVE-2023-52620: netfilter: nf_tables: disallow timeout for anonymous sets

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow timeout for anonymous sets Never used from userspace, disallow these parameters.

LowCVSS 2.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2023-52620 is a low-severity Linux kernel netfilter/nf_tables issue. The kernel change disallows timeout parameters for anonymous sets because they were not intended for userspace use. The published impact is limited to low availability impact, with no confidentiality or integrity impact reported.

Executive priority

Handle through routine kernel patch management unless affected systems are highly sensitive or exposed to untrusted local users. There is no source-backed evidence of active exploitation or data compromise risk.

Technical view

The issue is in Linux kernel nf_tables handling of anonymous set timeout parameters. The CVSS vector is local, high complexity, low privileges, no user interaction, unchanged scope, and low availability impact only. Kernel stable references show fixes that disallow these parameters.

Likely exposure

Exposure is limited to systems running affected Linux kernel versions with netfilter/nf_tables available. The CVE data describes local access with low privileges; it does not indicate remote exposure or broad unauthenticated attack surface.

Exploitation context

The source bundle does not report active exploitation, and KEV is false. No cited source provides exploit status, exploit maturity, or public weaponization details.

Researcher notes

Evidence is sparse. The bundle identifies the kernel subsystem, CVSS attributes, stable commit references, Debian LTS advisories, and Siemens advisory, but does not provide detailed root cause, exploitability notes, or distribution-specific package versions.

Mitigation direction

  • Check your Linux distribution or vendor advisory for patched kernel packages.
  • Prioritize normal kernel update workflows over emergency response.
  • Track Debian LTS and Siemens guidance if those environments apply.
  • Avoid inventing local workarounds unless your vendor documents one.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and embedded assets.
  • Confirm whether affected systems use vendor kernels containing the referenced stable fixes.
  • Review package advisory status for Debian LTS or Siemens-managed environments.
  • Verify update completion through standard kernel package and reboot tracking.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-52620 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Low
CVSS
2.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
3ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
2.5CVSS 3.1LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L11.4CISA-ADP

Vulnerability scoring details

Base CVSS 3.1 score

2.5Low
CVSS 3.1 vector shape for CVE-2023-52620Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
cvssV3_1other:ssvc
CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux761da2935d6e18d178582dbdf315a3a458555505, 761da2935d6e18d178582dbdf315a3a458555505, 761da2935d6e18d178582dbdf315a3a458555505, 761da2935d6e18d178582dbdf315a3a458555505, 761da2935d6e18d178582dbdf315a3a458555505, 761da2935d6e18d178582dbdf315a3a458555505unaffected
LinuxLinux4.1, 0, 4.19.312, 5.4.274, 5.10.215, 5.15.151, 6.1.81, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.