#VU91506 Improper locking in Linux kernel - CVE-2023-52796
Vulnerability identifier: #VU91506
Vulnerability risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-667
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper locking within the ipvlan_addr_lookup(), IS_ENABLED() and ipvlan_process_v6_outbound() functions in drivers/net/ipvlan/ipvlan_core.c. A local user can perform a denial of service (DoS) attack.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel: 4.19 - 4.19.299, 5.4 - 5.4.261, 5.10 - 5.10.201, 5.15 - 5.15.139, 6.1 - 6.1.63, 6.5 - 6.5.12, 6.6 - 6.6.2, 6.7 rc1 - 6.7 rc7
External links
https://git.kernel.org/stable/c/4f7f850611aa27aaaf1bf5687702ad2240ae442a
https://git.kernel.org/stable/c/4d2d30f0792b47908af64c4d02ed1ee25ff50542
https://git.kernel.org/stable/c/43b781e7cb5cd0b435de276111953bf2bacd1f02
https://git.kernel.org/stable/c/1f64cad3ac38ac5978b53c40e6c5e6fd3477c68f
https://git.kernel.org/stable/c/732a67ca436887b594ebc43bb5a04ffb0971a760
https://git.kernel.org/stable/c/8872dc638c24bb774cd2224a69d72a7f661a4d56
https://git.kernel.org/stable/c/03cddc4df8c6be47fd27c8f8b87e5f9a989e1458
https://git.kernel.org/stable/c/18f039428c7df183b09c69ebf10ffd4e521035d2
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.300
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.202
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.140
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.262
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.64
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.13
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.3
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.7
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?
