Security readout for executives and security teams
Plain-English summary
This is a Linux kernel memory-read flaw in netfilter connection tracking for DCCP traffic. A low-privileged local user could trigger an out-of-bounds stack read, potentially exposing sensitive kernel memory or causing instability. The source bundle includes upstream stable fixes but no evidence of active exploitation.
Executive priority
Treat as high priority for shared Linux infrastructure and systems with untrusted local users. It is not currently shown as actively exploited, but the potential confidentiality and availability impact justifies prompt patch planning through normal kernel maintenance channels.
Technical view
nf_conntrack_dccp_packet() copied only the basic DCCP header into a stack buffer, then later logic could read beyond that buffer when processing DCCP sequence fields and packet-type headers. KASAN reported a stack-out-of-bounds read. The fix expands validation and copies enough header data before use.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions with netfilter conntrack DCCP handling reachable. The CVSS vector is local with low privileges, so prioritize multi-user hosts, container platforms, and systems where untrusted users can interact with networking behavior.
Exploitation context
The bundle marks KEV as false and provides no cited evidence of exploitation in the wild. The vulnerability was identified with KASAN/syzkaller-style testing evidence, and the public text describes the bug and fix but not weaponized exploitation.
Researcher notes
Evidence is limited to the CVE record and Linux stable commit references. The affected-version data is broad and branch-oriented, so exact exposure should be resolved through distribution advisories and backport status rather than raw upstream version comparison alone.
Mitigation direction
- Apply vendor kernel updates containing the referenced stable fixes.
- Prioritize affected Linux kernels listed in the CVE source bundle.
- Follow distribution guidance before changing DCCP or conntrack behavior.
- Track vendor advisories for backported fixed kernel builds.
Validation and detection
- Inventory running Linux kernel versions across servers and container hosts.
- Check vendor advisories for CVE-2023-53333 fixed package versions.
- Confirm whether netfilter conntrack DCCP support is present or reachable.
- Verify patched systems include the relevant upstream stable fix or vendor backport.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-53333 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H1.85.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/337fdce450637ea663bc816edc2ba81e5cdad02eCVE reference, Linux
- https://git.kernel.org/stable/c/9bdcda7abaf22f6453e5b5efb7eb4e524095d5d8CVE reference, Linux
- https://git.kernel.org/stable/c/c052797ac36813419ad3bfa54cb8615db4b41f15CVE reference, Linux
- https://git.kernel.org/stable/c/5c618daa5038712c4a4ef8923905a2ea1b8836a1CVE reference, Linux
- https://git.kernel.org/stable/c/26bd1f210d3783a691052c51d76bb8a8bbd24c67CVE reference, Linux
- https://git.kernel.org/stable/c/8c0980493beed3a80d6329c44ab293dc8c032927CVE reference, Linux
- https://git.kernel.org/stable/c/ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.