{"id":"CVE-2023-53733","state":"PUBLISHED","title":"net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode\n\nWhen u32_replace_hw_knode fails, we need to undo the tcf_bind_filter\noperation done at u32_set_parms.","publishedAt":"2025-10-24T11:44:28.115Z","updatedAt":"2026-10-30T12:17:33.672Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d34e3e181395192d6d1f50dd97bd7854e04e33a4","status":"affected","lessThan":"d83345a8c0143ea31822be0aeb91a63bfc58215e","versionType":"git"},{"version":"d34e3e181395192d6d1f50dd97bd7854e04e33a4","status":"affected","lessThan":"3d5edcd3bca4aff15a18e45c79df1525059ab0e2","versionType":"git"},{"version":"d34e3e181395192d6d1f50dd97bd7854e04e33a4","status":"affected","lessThan":"a9345793469b65ee5ba7b033239916c2a67d3dd4","versionType":"git"},{"version":"d34e3e181395192d6d1f50dd97bd7854e04e33a4","status":"affected","lessThan":"025159ed118ba5145b241d574edadb0e00d3c20f","versionType":"git"},{"version":"d34e3e181395192d6d1f50dd97bd7854e04e33a4","status":"affected","lessThan":"9cb36faedeafb9720ac236aeae2ea57091d90a09","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/cls_u32.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.7","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.42","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.4.7","status":"unaffected","lessThanOrEqual":"6.4.*","versionType":"semver"},{"version":"6.5","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/cls_u32.c"]}],"references":["https://git.kernel.org/stable/c/d83345a8c0143ea31822be0aeb91a63bfc58215e","https://git.kernel.org/stable/c/3d5edcd3bca4aff15a18e45c79df1525059ab0e2","https://git.kernel.org/stable/c/a9345793469b65ee5ba7b033239916c2a67d3dd4","https://git.kernel.org/stable/c/025159ed118ba5145b241d574edadb0e00d3c20f","https://git.kernel.org/stable/c/9cb36faedeafb9720ac236aeae2ea57091d90a09"],"weaknesses":[],"ingestedAt":"2026-10-30T12:34:06.950Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/53xxx/CVE-2023-53733.json","commit":"db8103c5921aac81d5d90efcf3745980dafabf49","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53733","state":"PUBLISHED","datePublished":"2025-10-24T11:44:28.115Z","dateUpdated":"2026-10-30T12:17:33.672Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-10-22T13:21:37.350Z"},"containers":{"cna":{"title":"net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode\n\nWhen u32_replace_hw_knode fails, we need to undo the tcf_bind_filter\noperation done at u32_set_parms."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d34e3e181395192d6d1f50dd97bd7854e04e33a4","status":"affected","lessThan":"d83345a8c0143ea31822be0aeb91a63bfc58215e","versionType":"git"},{"version":"d34e3e181395192d6d1f50dd97bd7854e04e33a4","status":"affected","lessThan":"3d5edcd3bca4aff15a18e45c79df1525059ab0e2","versionType":"git"},{"version":"d34e3e181395192d6d1f50dd97bd7854e04e33a4","status":"affected","lessThan":"a9345793469b65ee5ba7b033239916c2a67d3dd4","versionType":"git"},{"version":"d34e3e181395192d6d1f50dd97bd7854e04e33a4","status":"affected","lessThan":"025159ed118ba5145b241d574edadb0e00d3c20f","versionType":"git"},{"version":"d34e3e181395192d6d1f50dd97bd7854e04e33a4","status":"affected","lessThan":"9cb36faedeafb9720ac236aeae2ea57091d90a09","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/cls_u32.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.7","versionType":"semver"},{"version":"5.10.273","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.224","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.42","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.4.7","status":"unaffected","lessThanOrEqual":"6.4.*","versionType":"semver"},{"version":"6.5","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/sched/cls_u32.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/d83345a8c0143ea31822be0aeb91a63bfc58215e"},{"url":"https://git.kernel.org/stable/c/3d5edcd3bca4aff15a18e45c79df1525059ab0e2"},{"url":"https://git.kernel.org/stable/c/a9345793469b65ee5ba7b033239916c2a67d3dd4"},{"url":"https://git.kernel.org/stable/c/025159ed118ba5145b241d574edadb0e00d3c20f"},{"url":"https://git.kernel.org/stable/c/9cb36faedeafb9720ac236aeae2ea57091d90a09"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through the rtnetlink `RTM_NEWTFILTER` interface (tc filter add/change) on the local system; no network peer can drive filter configuration. Packet transmission only serves to consume the corrupted state afterwards.\nAC:L - Failure of `u32_replace_hw_knode()` is fully attacker-controlled — setting the `skip_sw` flag on a filter attached to a non-offload-capable device (dummy/veth/lo) makes `tc_setup_cb_add()` return `-EOPNOTSUPP` deterministically on every attempt, with no race and no dependence on state outside the attacker's control.\nPR:L - Only `CAP_NET_ADMIN` within a network namespace is needed, which any unprivileged local user obtains with `unshare -Urn` before creating a dummy device, an HTB qdisc with classes, and u32 filters. Per kernel CNA guidance, tc/qdisc paths reachable via user namespaces are PR:L, not PR:H.\nUI:N - The attacker performs the entire sequence (create qdisc/class, repeatedly issue the failing filter add, delete the class, send traffic) unaided. No victim action is required at any point.\nS:U - The corrupted `filter_cnt` accounting and the resulting freed `htb_class` object both live in the kernel of the same machine, so the impact stays within a single security authority. This is standard kernel-local privilege escalation, not a hypervisor or IOMMU boundary crossing.\nC:H - The refcount imbalance permits a still-referenced traffic class to be freed while `res.class` remains a dangling pointer consumed by `htb_classify()`, giving a use-after-free on a slab object the attacker can reallocate and read back. Per guidance, a UAF that grants control over freed-object contents is High confidentiality impact.\nI:H - The same use-after-free lets a sprayed replacement object supply `cl->level`, `cl->leaf.q` and the qdisc function pointers dereferenced in the enqueue path, yielding a write/control-flow-hijack primitive — the same primitive that produced working local privilege escalation for the sibling cls_u32 tcf_result bugs. Type-confused/UAF corruption of kernel objects is High integrity impact.\nA:H - Even without exploitation, the leaked `filter_cnt` permanently pins the class and its qdisc so `tc class del` always returns `-EBUSY` and the memory is never reclaimed, and the dangling `res.class` dereference in the packet enqueue path oopses the kernel. Any kernel crash or use-after-free is High availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:17:33.672Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.10.273"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"5.15.224"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.1.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.4.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.7","versionEndExcluding":"6.5"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2023-53733","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:36:55.863710Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T21:41:35.062Z"}}]}}}