CVE-2023-53147

Q: What is the severity of CVE-2023-53147?

CVE-2023-53147 has a CVSS score of 5.5 (MEDIUM). A NULL pointer dereference vulnerability in the Linux kernel's XFRM subsystem allows local users to crash the kernel by triggering a specific condition in xfrm_update_ae_params. This affects systems using IPsec/XFRM functionality and requires local access to exploit.

5.5 MEDIUM

Denial of Service

📋 TL;DR

A NULL pointer dereference vulnerability in the Linux kernel's XFRM subsystem allows local users to crash the kernel by triggering a specific condition in xfrm_update_ae_params. This affects systems using IPsec/XFRM functionality and requires local access to exploit.

💻 Affected Systems

Products:

Linux kernel

Versions: Versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using vulnerable kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires XFRM/IPsec functionality to be enabled and accessible via xfrm_new_ae.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash and denial of service, potentially disrupting network security functions like IPsec tunnels.

🟠

Likely Case

Local denial of service through kernel crash, requiring system reboot to recover.

🟢

If Mitigated

Minimal impact with proper access controls limiting local user privileges.

🌐 Internet-Facing: LOW - Requires local access, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local users with sufficient privileges can cause system crashes.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Proof-of-concept crash code exists in vulnerability description. Requires local access and ability to trigger xfrm_new_ae.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits 00374d9b6d9f932802b55181be9831aa948e5b7c or similar

Vendor Advisory: https://git.kernel.org/stable/c/00374d9b6d9f932802b55181be9831aa948e5b7c

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Restrict XFRM access

all

Limit access to XFRM functionality via capabilities or user permissions

Use Linux capabilities system to restrict CAP_NET_ADMIN
Implement strict user/group permissions on XFRM interfaces

🧯 If You Can't Patch

Implement strict access controls to prevent unauthorized users from accessing XFRM functionality
Monitor for kernel crashes and investigate any local user triggering XFRM operations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and compare against distribution security advisories. Vulnerable if using unpatched kernel with XFRM enabled.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commit or is newer than patched versions from your distribution.

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs mentioning xfrm_update_ae_params
NULL pointer dereference in kernel logs
System crash/reboot events

Network Indicators:

Unusual XFRM/IPsec configuration changes from local users

SIEM Query:

source="kernel" AND ("NULL pointer dereference" OR "xfrm_update_ae_params" OR "kernel panic")

📊 Metadata

CVE ID: CVE-2023-53147

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

EPSS Score: 0.01% exploit probability (1.2th percentile)

Published: September 15, 2025

Last Updated: November 25, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Restrict XFRM access

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities