CVE-2023-52924

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified)

Description: The issue is related to an asymmetry between commit/abort and preparation phase in the Linux kernel's netfilter nf tables. This occurs when a set is a verdict map and timeouts are enabled. A problematic sequence can happen when an element in a set refers to a chain, and the set is removed. If the element has already expired, it will be ignored during the list walk, resulting in a leaked chain use count and a potential WARN splat when the chain is removed later. The nf tables set elem destroy() function is only safe for elements that have been deactivated earlier from the preparation phase. Updating pipapo get() to not skip expired elements resolves the issue.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.