PT-2025-18897 · Linux+3 · Linux Kernel+3

Published 2025-05-02 · Updated 2026-03-14 · CVE-2023-53133

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the fixed version

Description The issue is related to an infinite loop error in the tcp bpf recvmsg parser() function when the buffer length of the recvmsg system call is 0. This can cause a soft lockup problem. The logic in tcp bpf recvmsg parser is flawed, leading to an infinite loop when the copied value is always 0. To fix this, the function should directly return when the length is 0.

Recommendations For Linux kernel versions prior to the fixed version, modify the tcp bpf recvmsg parser() function to directly return when the length is 0. Additionally, modify other functions with the same problem to prevent infinite loops.

Note: The exact fixed version is not specified, so it is recommended to update to the latest version available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

BDU:2026-05866

CVE-2023-53133

SUSE-SU-2025:02334-1

SUSE-SU-2025_02334-1

Affected Products

Astra Linux

Debian

Linux Kernel

Suse

References · 291

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53133.json · Exploit
• https://git.kernel.org/stable/c/d900f3d20cc3169ce42ec72acc850e662a4d4db2 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53133 · Security Note
• https://git.kernel.org/stable/c/f45cf3ae3068e70e2c7f3e24a7f8e8aa99511f03 · Patch
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2023-53133 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:02334-1 · Vendor Advisory
• https://git.kernel.org/stable/c/bf0579989de64d36e177c0611c685dc4a91457a7 · Patch
• https://osv.dev/vulnerability/CVE-2023-53133 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-53133 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-53133 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-53133 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53133 · Vendor Advisory
• https://git.kernel.org/stable/c/4a476285f6d2921c3c9faa494eab83b78f78fc55 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2023-53133 · Vendor Advisory