Security readout for executives and security teams
Plain-English summary
A Linux kernel authorization gap lets a low-privileged local user attach the GSM 07.10 terminal line discipline without the intended administrative capability. The correction requires CAP_NET_ADMIN in the initial namespace. The issue is rated 7.8 high, although the supplied sources do not explain a complete exploit chain.
Executive priority
Treat this as a high-priority kernel update, especially on shared systems permitting untrusted local execution. It warrants prompt remediation through normal emergency-capable patch processes, but the supplied evidence does not justify describing it as an active exploitation emergency.
Technical view
Before the fix, an unprivileged user could attach the N_GSM0710 line discipline. Stable kernel patches add an initial-user-namespace CAP_NET_ADMIN check when attaching it. The CVSS vector describes local, low-complexity exploitation requiring low privileges and no user interaction, with potentially high confidentiality, integrity, and availability impact.
Likely exposure
Potential exposure exists on Linux systems running affected kernel builds where low-privileged users or processes can execute locally. The bundle identifies affected entries involving Linux 2.6.35, 4.19.312, 5.4.274, 5.10.215, 5.15.155, 6.1.86, and 6.6. Exact distribution package boundaries are not supplied.
Exploitation context
The bundle marks this CVE as absent from KEV, and no supplied source reports active exploitation. The documented attack vector is local, so this is not presented as a directly remote compromise. Public exploit availability and the precise mechanism producing the CVSS impact are not established by the supplied evidence.
Researcher notes
The security boundary is specifically CAP_NET_ADMIN in the initial user namespace, not merely a namespaced capability. Multiple stable backports and Debian LTS notices are referenced. The bundle does not provide a CWE, definitive distribution package mapping, public exploit evidence, or technical details connecting unauthorized attachment to the scored confidentiality, integrity, and availability impacts.
Mitigation direction
- Install a vendor-supported kernel package containing the applicable upstream stable fix.
- Consult distribution advisories to identify the exact fixed package for each kernel branch.
- Reboot updated systems so the corrected kernel becomes active.
- Until patched, reduce untrusted local account and process access on affected hosts.
Validation and detection
- Inventory running kernel versions and installed kernel packages across the Linux estate.
- Compare each build with distribution advisories and the relevant upstream stable fix.
- Confirm updated systems are running the corrected kernel after reboot.
- In a controlled test, verify attachment requires initial-namespace CAP_NET_ADMIN.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-52880 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7d303dee473ba3529d75b63491e9963342107bedCVE reference, Linux
- https://git.kernel.org/stable/c/7a529c9023a197ab3bf09bb95df32a3813f7ba58CVE reference, Linux
- https://git.kernel.org/stable/c/ada28eb4b9561aab93942f3224a2e41d76fe57faCVE reference, Linux
- https://git.kernel.org/stable/c/2d154a54c58f9c8375bfbea9f7e51ba3bfb2e43aCVE reference, Linux
- https://git.kernel.org/stable/c/2b85977977cbd120591b23c2450e90a5806a7167CVE reference, Linux
- https://git.kernel.org/stable/c/67c37756898a5a6b2941a13ae7260c89b54e0d88CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlCVE reference, CVE · x_transferred
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.htmlCVE reference, CVE · x_transferred
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.