Linux Kernel Netfilter Vulnerability Affecting Expectation Handling

CVE-2023-52927

Summary

A vulnerability in the Linux kernel's netfilter module has been identified, involving the incorrect handling of expectations during connection tracking. Specifically, the function nf_conntrack_in() erroneously removes expectations from the hash table under certain conditions. The recent patches allow these expectations to remain intact by setting the IPS_CONFIRMED status, addressing situations where connection tracking might not confirm the created connection template. This change enhances stability and security within network configurations that utilize Open vSwitch (OVS) and traffic control (TC) mechanisms.

References