The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: bpf: reject unhashed sockets in     bpf_sk_assign The semantics for bpf_sk_assign are as follows: sk = some_lookup_func() bpf_sk_assign(skb,     sk) bpf_sk_release(sk) That is, the sk is not consumed by bpf_sk_assign. The function therefore needs to     make sure that sk lives long enough to be consumed from __inet_lookup_skb. The path through the stack for     a TCPv4 packet is roughly: netif_receive_skb_core: takes RCU read lock __netif_receive_skb_core:
    sch_handle_ingress: tcf_classify: bpf_sk_assign() deliver_ptype_list_skb: deliver_skb:
    ip_packet_type->func == ip_rcv: ip_rcv_core: ip_rcv_finish_core: dst_input: ip_local_deliver:
    ip_local_deliver_finish: ip_protocol_deliver_rcu: tcp_v4_rcv: __inet_lookup_skb: skb_steal_sock The     existing helper takes advantage of the fact that everything happens in the same RCU critical section: for     sockets with SOCK_RCU_FREE set bpf_sk_assign never takes a reference. skb_steal_sock then checks     SOCK_RCU_FREE again and does sock_put if necessary. This approach assumes that SOCK_RCU_FREE is never set     on a sk between bpf_sk_assign and skb_steal_sock, but this invariant is violated by unhashed UDP sockets.
    A new UDP socket is created in TCP_CLOSE state but without SOCK_RCU_FREE set. That flag is only added in     udp_lib_get_port() which happens when a socket is bound. When bpf_sk_assign was added it wasn't possible     to access unhashed UDP sockets from BPF, so this wasn't a problem. This changed in commit 0c48eefae712     (sock_map: Lift socket state restriction for datagram sockets), but the helper wasn't adjusted     accordingly. The following sequence of events will therefore lead to a refcount leak: 1. Add     socket(AF_INET, SOCK_DGRAM) to a sockmap. 2. Pull socket out of sockmap and bpf_sk_assign it. Since     SOCK_RCU_FREE is not set we increment the refcount. 3. bind() or connect() the socket, setting     SOCK_RCU_FREE. 4. skb_steal_sock will now set refcounted = false due to SOCK_RCU_FREE. 5. tcp_v4_rcv()     skips sock_put(). Fix the problem by rejecting unhashed sockets in bpf_sk_assign(). This matches the     behaviour of __inet_lookup_skb which is ultimately the goal of bpf_sk_assign(). (CVE-2023-53585)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2023-53585

high Nessus Plugin ID 269372

Version 1.4

Version 1.3

Version 1.1

Version 1.4 Nov 26, 2025, 1:15 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202511261315
Version 1.3 Oct 27, 2025, 11:56 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:U/RL:U/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:U/RL:U/RC:C") Detection (updated detection logic) Plugin metadata Plugin Feed: 202510272356
Version 1.1 Oct 8, 2025, 9:19 AM New Plugin Feed: 202510080919