GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-53033 (GCVE-0-2023-53033)

Vulnerability from cvelistv5 – Published: 2025-03-27 16:44 – Updated: 2026-08-05 09:12
VLAI
Title
netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits If the offset + length goes over the ethernet + vlan header, then the length is adjusted to copy the bytes that are within the boundaries of the vlan_ethhdr scratchpad area. The remaining bytes beyond ethernet + vlan header are copied directly from the skbuff data area. Fix incorrect arithmetic operator: subtract, not add, the size of the vlan header in case of double-tagged packets to adjust the length accordingly to address CVE-2023-0179.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f6ae9f120dada00abfb47313364c35118469455f , < 550efeff989b041f3746118c0ddd863c39ddc1aa (git)
Affected: f6ae9f120dada00abfb47313364c35118469455f , < a8acfe2c6fb99f9375a9325807a179cd8c32e6e3 (git)
Affected: f6ae9f120dada00abfb47313364c35118469455f , < 76ef74d4a379faa451003621a84e3498044e7aa3 (git)
Affected: f6ae9f120dada00abfb47313364c35118469455f , < 696e1a48b1a1b01edad542a1ef293665864a4dd0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 5.10.164 , ≤ 5.10.* (semver)
Unaffected: 5.15.89 , ≤ 5.15.* (semver)
Unaffected: 6.1.7 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_payload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "550efeff989b041f3746118c0ddd863c39ddc1aa",
              "status": "affected",
              "version": "f6ae9f120dada00abfb47313364c35118469455f",
              "versionType": "git"
            },
            {
              "lessThan": "a8acfe2c6fb99f9375a9325807a179cd8c32e6e3",
              "status": "affected",
              "version": "f6ae9f120dada00abfb47313364c35118469455f",
              "versionType": "git"
            },
            {
              "lessThan": "76ef74d4a379faa451003621a84e3498044e7aa3",
              "status": "affected",
              "version": "f6ae9f120dada00abfb47313364c35118469455f",
              "versionType": "git"
            },
            {
              "lessThan": "696e1a48b1a1b01edad542a1ef293665864a4dd0",
              "status": "affected",
              "version": "f6ae9f120dada00abfb47313364c35118469455f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_payload.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.164",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.89",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.164",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.89",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.7",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits\n\nIf the offset + length goes over the ethernet + vlan header, then the\nlength is adjusted to copy the bytes that are within the boundaries of\nthe vlan_ethhdr scratchpad area. The remaining bytes beyond ethernet +\nvlan header are copied directly from the skbuff data area.\n\nFix incorrect arithmetic operator: subtract, not add, the size of the\nvlan header in case of double-tagged packets to adjust the length\naccordingly to address CVE-2023-0179."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached by installing crafted nftables nft_payload rules via netlink and then processing packets in that chain; netfilter/nftables rule install is a local attack surface, not remote pre-auth packet parsing alone.\nAC:L - An attacker fully controls the prerequisites by creating VLAN interfaces and nftables rules in their own netns and sending packets that hit the path; public PoCs trigger the overflow reliably with no races or luck.\nPR:L - CAP_NET_ADMIN is required for nfnetlink/nftables, but it is obtainable by an unprivileged user via user+network namespaces (unshare -Urn), which scores as Low per kernel CNA guidance.\nUI:N - The attacker installs rules and triggers packet evaluation themselves; no victim action is required.\nS:U - Impact is local kernel memory corruption and privilege escalation within the host kernel authority, not a cross-boundary escape such as guest-to-host or IOMMU bypass.\nC:H - The stack OOB write overwrites adjacent nft_regs and enables reliable leakage of stack/heap kernel addresses (KASLR defeat), giving a high-impact confidentiality compromise.\nI:H - Controlled stack overflow of regs/jumpstack enables expression/control-flow hijacking and demonstrated arbitrary kernel write (e.g. modprobe_path) for local root.\nA:H - Corrupt jumpstack/rule pointers readily cause kernel GPFs and panics, so availability impact is complete host crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:12:27.289Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/550efeff989b041f3746118c0ddd863c39ddc1aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8acfe2c6fb99f9375a9325807a179cd8c32e6e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/76ef74d4a379faa451003621a84e3498044e7aa3"
        },
        {
          "url": "https://git.kernel.org/stable/c/696e1a48b1a1b01edad542a1ef293665864a4dd0"
        }
      ],
      "title": "netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53033",
    "datePublished": "2025-03-27T16:44:01.044Z",
    "dateReserved": "2025-03-27T16:40:15.758Z",
    "dateUpdated": "2026-08-05T09:12:27.289Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-53033",
      "date": "2026-09-16",
      "epss": "0.00197",
      "percentile": "0.09649"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53033\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-27T17:15:53.120\",\"lastModified\":\"2026-08-04T10:18:52.570\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits\\n\\nIf the offset + length goes over the ethernet + vlan header, then the\\nlength is adjusted to copy the bytes that are within the boundaries of\\nthe vlan_ethhdr scratchpad area. The remaining bytes beyond ethernet +\\nvlan header are copied directly from the skbuff data area.\\n\\nFix incorrect arithmetic operator: subtract, not add, the size of the\\nvlan header in case of double-tagged packets to adjust the length\\naccordingly to address CVE-2023-0179.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nft_payload: aritm\u00e9tica incorrecta al obtener bits del encabezado VLAN. Si el desplazamiento + longitud sobrepasa el encabezado Ethernet + VLAN, esta se ajusta para copiar los bytes dentro de los l\u00edmites del \u00e1rea de borrador vlan_ethhdr. Los bytes restantes m\u00e1s all\u00e1 del encabezado Ethernet + VLAN se copian directamente del \u00e1rea de datos skbuff. Se corrige el operador aritm\u00e9tico incorrecto: restar, no sumar, el tama\u00f1o del encabezado VLAN en el caso de paquetes con doble etiqueta para ajustar la longitud seg\u00fan la soluci\u00f3n CVE-2023-0179.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/nft_payload.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f6ae9f120dada00abfb47313364c35118469455f\",\"lessThan\":\"550efeff989b041f3746118c0ddd863c39ddc1aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f6ae9f120dada00abfb47313364c35118469455f\",\"lessThan\":\"a8acfe2c6fb99f9375a9325807a179cd8c32e6e3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f6ae9f120dada00abfb47313364c35118469455f\",\"lessThan\":\"76ef74d4a379faa451003621a84e3498044e7aa3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f6ae9f120dada00abfb47313364c35118469455f\",\"lessThan\":\"696e1a48b1a1b01edad542a1ef293665864a4dd0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/nft_payload.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.164\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.89\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.7\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.164\",\"matchCriteriaId\":\"CA742E66-32D2-459E-AB19-171C4DB3B1F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.89\",\"matchCriteriaId\":\"E706841F-E788-4316-9B05-DA8EB60CE6B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.7\",\"matchCriteriaId\":\"9275C81F-AE96-4CDB-AD20-7DBD36E5D909\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF501633-2F44-4913-A8EE-B021929F49F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2BDA597B-CAC1-4DF0-86F0-42E142C654E9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"725C78C9-12CE-406F-ABE8-0813A01D66E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A127C155-689C-4F67-B146-44A57F4BFD85\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/550efeff989b041f3746118c0ddd863c39ddc1aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/696e1a48b1a1b01edad542a1ef293665864a4dd0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/76ef74d4a379faa451003621a84e3498044e7aa3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a8acfe2c6fb99f9375a9325807a179cd8c32e6e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T10:33:14+00:00",
      "cve": "CVE-2023-53033",
      "id": "CVE-2023-53033",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "201",
      "product_status:known_affected": "50",
      "product_status:known_not_affected": "138",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-53033.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T23:48:53Z",
      "cve": "CVE-2023-53033",
      "id": "CVE-2023-53033",
      "initial_release_date": "2025-03-28T03:37:27Z",
      "product_status:known_not_affected": "312",
      "product_status:recommended": "259",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-53033",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-53033.json",
      "version": "30"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.