Linux Kernel up to 6.4.11 nftables run-tests.sh pipapo_get privilege escalation

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 6.4.11. This vulnerability affects the function pipapo_get of the file run-tests.sh of the component nftables. This manipulation causes an unknown weakness. This vulnerability is registered as CVE-2023-52925. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Linux Kernel up to 6.4.11. Affected by this vulnerability is the function pipapo_get of the file run-tests.sh of the component nftables. The impact remains unknown. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't fail inserts if duplicate has expired nftables selftests fail: run-tests.sh testcases/sets/0044interval_overlap_0 Expected: 0-2 . 0-3, got: W: [FAILED] ./testcases/sets/0044interval_overlap_0: got 1 Insertion must ignore duplicate but expired entries. Moreover, there is a strange asymmetry in nft_pipapo_activate: It refetches the current element, whereas the other ->activate callbacks (bitmap, hash, rhash, rbtree) use elem->priv. Same for .remove: other set implementations take elem->priv, nft_pipapo_remove fetches elem->priv, then does a relookup, remove this. I suspect this was the reason for the change that prompted the removal of the expired check in pipapo_get() in the first place, but skipping exired elements there makes no sense to me, this helper is used for normal get requests, insertions (duplicate check) and deactivate callback. In first two cases expired elements must be skipped. For ->deactivate(), this gets called for DELSETELEM, so it seems to me that expired elements should be skipped as well, i.e. delete request should fail with -ENOENT error.

It is possible to read the advisory at git.kernel.org. This vulnerability is known as CVE-2023-52925 since 08/21/2024. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 241963 (SUSE SLES15 Security Update : kernel (SUSE-SU-2025:02264-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.4.12 eliminates this vulnerability. Applying the patch 891ca5dfe3b718b441fc786014a7ba8f517da188/af78b0489e8898a8c9449ffc0fdd2e181916f0d4/59ee68c437c562170265194a99698c805a686bb3/156369a702c33ad5434a19c3a689bfb836d4e0b8/7845914f45f066497ac75b30c50dbc735e84e884 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (241963) and CERT Bund (WID-SEC-2025-1439). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• SUSE Linux
• Dell Secure Connect Gateway

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3
• 6.4.4
• 6.4.5
• 6.4.6
• 6.4.7
• 6.4.8
• 6.4.9
• 6.4.10
• 6.4.11

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion