Security readout for executives and security teams
Plain-English summary
A Linux kernel memory-safety flaw can occur when an IP VTI interface using the SFB queueing discipline transmits IPv6 traffic. A locally authenticated, low-privileged attacker may be able to trigger serious confidentiality, integrity, or availability impact, according to the supplied CVSS assessment.
Executive priority
Treat as high priority on systems matching the narrow networking configuration, especially shared or multi-user hosts. Patch through supported vendor channels after compatibility testing. Systems without ip_vti, SFB, or IPv6 transmission appear less likely to reach the vulnerable path, but should still be assessed against vendor guidance.
Technical view
SFB enqueueing may modify the socket-buffer control block. During IPv6 transmission through ip_vti, decode_session6 can then use invalid control-block state, potentially causing a slab use-after-free. The kernel fix clears the skb control block before transmission because xfrm_decode_session was intended for receive-path state.
Likely exposure
Exposure requires Linux systems with an ip_vti device configured with the SFB queueing discipline and sending IPv6 packets. The supplied data identifies affected kernel boundaries from 3.19 through 6.5, but does not provide complete distribution-specific package mappings. Confirm backports with each Linux vendor.
Exploitation context
The supplied CVSS 3.1 score is 7.8 and describes local access, low privileges, low complexity, and no user interaction. The bundle marks KEV as false and provides no cited evidence of active exploitation or a public exploit. Practical exploitability beyond triggering memory corruption is not established here.
Researcher notes
The record describes a potential slab use-after-free but assigns no CWE. Eight stable-kernel commit references indicate backports across branches. The affected-version data mixes release numbers with a commit identifier and does not clearly express every range, so exact distribution exposure and fix status require vendor confirmation.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the applicable stable fix.
- Check distribution advisories for backported fixes and corrected package versions.
- Where operationally acceptable, avoid combining ip_vti, SFB queueing, and IPv6 transmission until patched.
- Prioritize exposed multi-user systems where untrusted local users can influence networking configuration or traffic.
Validation and detection
- Inventory kernel versions and map them to distribution security advisories.
- Identify systems with ip_vti interfaces configured to use the SFB queueing discipline.
- Confirm whether affected interfaces transmit IPv6 traffic.
- Verify the installed kernel includes the applicable stable commit or vendor backport.
- Review kernel memory-safety reports or crashes, without treating their absence as proof of safety.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-53559 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/82fb41c5de243e7dfa90f32ca58e35adaff56c1dCVE reference, Linux
- https://git.kernel.org/stable/c/7dfe23659f3677c08a60a0056cda2d91a79c15caCVE reference, Linux
- https://git.kernel.org/stable/c/d34c30442d5e53a33cde79ca163320dbe2432cbdCVE reference, Linux
- https://git.kernel.org/stable/c/0b4d69539fdea138af2befe08893850c89248068CVE reference, Linux
- https://git.kernel.org/stable/c/e1e04cc2ef2c0c0866c19f5627149a76c2baae32CVE reference, Linux
- https://git.kernel.org/stable/c/2b05bf5dc437f7891dd409a3eaf5058459391c7aCVE reference, Linux
- https://git.kernel.org/stable/c/78e397a43e1c47321a4679cc49a6c4530bf820b9CVE reference, Linux
- https://git.kernel.org/stable/c/6018a266279b1a75143c7c0804dd08a5fc4c3e0bCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.