Security readout for executives and security teams
Plain-English summary
A Linux kernel memory-safety flaw can occur when an XFRM network device using an SFB queue transmits IPv6 packets. The kernel may read memory after it has been freed, potentially causing crashes or compromising confidentiality and integrity. Exploitation requires local access with low privileges according to the supplied CVSS assessment, and the affected configuration must be present.
Executive priority
Prioritize affected network appliances, VPN gateways, multi-user Linux systems, and other hosts using the specific XFRM/SFB/IPv6 configuration. Treat remediation as high priority but not an internet-wide emergency: the cited assessment requires local access, and no active exploitation evidence is supplied. Confirm exposure quickly, then patch through normal expedited kernel maintenance.
Technical view
During IPv6 transmission through an XFRM device with an SFB qdisc, enqueueing can modify the socket-buffer control field. Because the transmit path lacks the expected IPv6 offset state, decode_session6 may perform a slab use-after-free. The kernel fix clears the skb control field before transmission. CVSS 3.1 is 7.3: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H.
Likely exposure
Exposure is concentrated on affected Linux kernels where an XFRM device uses the SFB queue discipline and transmits IPv6 traffic. Systems without that configuration are less likely to reach the vulnerable path. The supplied version data is unusual and incomplete for distribution packages, so determine exposure through vendor backport status rather than version strings alone.
Exploitation context
The supplied CVSS vector describes local, low-privileged exploitation with no user interaction. Successful exploitation could have high confidentiality and availability impact and low integrity impact. The source bundle reports that this CVE is not in KEV and provides no evidence of active exploitation or a public exploit. Practical exploitability is therefore unconfirmed.
Researcher notes
The reported failure is a one-byte read from a freed skbuff_small_head object in decode_session6. The underlying state mismatch arises because xfrm_decode_session was designed for receive processing, while the transmit path does not initialize IP6CB(skb)->nhoff. The resolution clears skb->cb before sending. The bundle lists multiple stable-kernel commits, indicating branch-specific fixes; distribution backports require separate confirmation.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream fix or confirmed backport.
- Check distribution security guidance because package versions may not match upstream kernel versions.
- Pending updates, avoid the XFRM-device, SFB-qdisc, and IPv6 combination where operationally acceptable.
- Restrict unnecessary local access and privileged network-configuration capabilities.
Validation and detection
- Inventory kernel and distribution package versions across Linux systems.
- Identify hosts using XFRM devices, SFB queue disciplines, and IPv6 transmission.
- Confirm the installed kernel includes the applicable fix or vendor backport.
- After updating, test required XFRM IPv6 traffic and monitor for kernel memory or crash reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-53500 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H1.85.5LinuxVulnerability scoring details
Base CVSS 3.1 score
7.3HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/da4cbaa75ed088b6d70db77b9103a27e2359e243CVE reference, Linux
- https://git.kernel.org/stable/c/db0e50741f0387f388e9ec824ea7ae8456554d5bCVE reference, Linux
- https://git.kernel.org/stable/c/bafa236380816b41b2c4c6970d9067fefa4a6c9eCVE reference, Linux
- https://git.kernel.org/stable/c/44b3d40967009304617a7a6486490c1d6c12f899CVE reference, Linux
- https://git.kernel.org/stable/c/0d27567fde5be5f0edc2db5c110142b7915b8fa8CVE reference, Linux
- https://git.kernel.org/stable/c/86f15300a22656db3fa8c8967defbcd24fac4d37CVE reference, Linux
- https://git.kernel.org/stable/c/53223f2ed1ef5c90dad814daaaefea4e68a933c8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.