CVE-2023-1206 — Uncontrolled Resource Consumption in Kernel

CWE-400 — Uncontrolled Resource ConsumptionCWE-327 — Use of a Broken or Risky Cryptographic Algorithm41 documents10 sources
Severity
5.7MEDIUMNVD
OSV7.0OSV5.5OSV4.7OSV4.1
EPSS
0.0%
top 88.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Linux KernelFedoraproject FedoraRedhat Enterprise Linux
Timeline
PublishedJun 30
Latest updateFeb 13

Description

A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.1 | Impact: 3.6

Affected Packages4 packages

▶Debianlinux/linux_kernel< 5.10.191-1+3
▶Ubuntulinux/linux_kernel< 5.4.0-164.181+4
▶CVEListV5linux/linux_kernelkernel 6.5-rc1

Also affects: Enterprise Linux 8.0, 9.0, Fedora 38

🔴Vulnerability Details

19
OSV
linux-nvidia-6.2 vulnerabilities↗2023-10-31
▶
OSV
linux vulnerabilities↗2023-10-30
▶
OSV
linux-aws-hwe vulnerabilities↗2023-10-25
▶
OSV
linux-intel-iotg-5.15 vulnerabilities↗2023-10-24
▶
OSV
linux-aws vulnerabilities↗2023-10-23
▶

📋Vendor Advisories

20
CISA ICS
Siemens SCALANCE W700↗2025-02-13
▶
CISA ICS
Siemens SCALANCE XCM-/XRM-300↗2024-02-15
▶
Ubuntu
Linux kernel (NVIDIA) vulnerabilities↗2023-10-31
▶
Ubuntu
Linux kernel vulnerabilities↗2023-10-30
▶
Ubuntu
Linux kernel (HWE) vulnerabilities↗2023-10-25
▶

💬Community

1
Bugzilla
CVE-2023-1206 kernel: hash collisions in the IPv6 connection lookup table↗2023-03-06
▶
CVE-2023-1206 — Uncontrolled Resource Consumption | cvebase