CVE-2023-28219
published 2023-04-11CVE-2023-28219: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
PriorityP358high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EPSS
14.98%
96.3th percentile
Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Affected
48 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux_kernel | >= 3.12.0 < 4.14.316 | 4.14.316 |
| linux | linux_kernel | >= 4.15.0 < 4.19.284 | 4.19.284 |
| linux | linux_kernel | >= 4.20.0 < 5.4.244 | 5.4.244 |
| linux | linux_kernel | >= 5.11.0 < 5.15.113 | 5.15.113 |
| linux | linux_kernel | >= 5.16.0 < 6.1.30 | 6.1.30 |
| linux | linux_kernel | >= 5.5.0 < 5.10.181 | 5.10.181 |
| linux | linux_kernel | >= 6.2.0 < 6.3.4 | 6.3.4 |
| microsoft | windows_10_1507 | < 10.0.10240.19869 | 10.0.10240.19869 |
| microsoft | windows_10_1607 | < 10.0.14393.5850 | 10.0.14393.5850 |
| microsoft | windows_10_1809 | < 10.0.17763.4252 | 10.0.17763.4252 |
| microsoft | windows_10_20h2 | < 10.0.19042.2846 | 10.0.19042.2846 |
| microsoft | windows_10_21h2 | < 10.0.19044.2846 | 10.0.19044.2846 |
| microsoft | windows_10_22h2 | < 10.0.19045.2846 | 10.0.19045.2846 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.19869 | 10.0.10240.19869 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.5850 | 10.0.14393.5850 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.4252 | 10.0.17763.4252 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.4252 | 10.0.17763.4252 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.2846 | 10.0.19042.2846 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19044.2846 | 10.0.19044.2846 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.2846 | 10.0.19045.2846 |
| microsoft | windows_11_21h2 | < 10.0.22000.1817 | 10.0.22000.1817 |
| microsoft | windows_11_22h2 | < 10.0.22621.1555 | 10.0.22621.1555 |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.1817 | 10.0.22000.1817 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.1555 | 10.0.22621.1555 |
| microsoft | windows_server_2008 | — | — |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.1HIGH
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
netlink: annotate accesses to nlk->cb_running
osv·2025-12-09
CVE-2023-53853 netlink: annotate accesses to nlk->cb_running
netlink: annotate accesses to nlk->cb_running
In the Linux kernel, the following vulnerability has been resolved:
netlink: annotate accesses to nlk->cb_running
Both netlink_recvmsg() and netlink_native_seq_show() read
nlk->cb_running locklessly. Use READ_ONCE() there.
Add corresponding WRITE_ONCE() to netlink_dump() and
__netlink_dump_start()
syzbot reported:
BUG: KCSAN: data-race in __netlink_dump_start / netlink_recvmsg
write to 0xffff88813ea4db59 of 1 bytes by task 28219 on cpu 0:
__netlink_dump_start+0x3af/0x4d0 net/netlink/af_netlink.c:2399
netlink_dump_start include/linux/netlink.h:308 [inline]
rtnetlink_rcv_msg+0x70f/0x8c0 net/core/rtnetlink.c:6130
netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2577
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6192
netlink_unicast_kernel
GHSA
GHSA-gj3h-frf4-5mrw: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
ghsa_unreviewed·2023-04-11
CVE-2023-28219 [HIGH] GHSA-gj3h-frf4-5mrw: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Microsoft
Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
vendor_msrc·2023-04-11·CVSS 8.1
CVE-2023-28219 [HIGH] CWE-591 Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.
FAQ: How could an attacker exploit this vulnerability?
An unauthenticated attacker could send a specially crafted protocol message to a Routing and Remote Access Service (RRAS) server, which could lead to remote code execution (RCE) on the RAS server machine.
Windows Layer 2 Tunneling Protocol: Windows Layer 2 Tunneling Protocol
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Sof
No detection rules found.
No public exploits indexed.
Qualys
Microsoft and Adobe Patch Tuesday April 2023 Security Update Review | Qualys
blogs_qualys·2023-04-12
Microsoft and Adobe Patch Tuesday April 2023 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for April 2023
- Adobe Patches for April 2023
- Zero-day Vulnerability Patched in April Patch Tuesday Edition
- Other Critical Severity Vulnerabilities Patched in April Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
- Qualys Monthly Webinar Series
- This Month in Vulnerabilities & Patches
Microsoft released security updates to address 114 vulnerabilities in the April Patch Tuesday edition. The security advisories co
Krebs
Microsoft (& Apple) Patch Tuesday, April 2023 Edition
blogs_krebs·2023-04-12·CVSS 8.8
CVE-2023-28206 [HIGH] Microsoft (& Apple) Patch Tuesday, April 2023 Edition
Microsoft today released software updates to plug 100 security holes in its Windows operating systems and other software, including a zero-day vulnerability that is already being used in active attacks. Not to be outdone, Apple has released a set of important updates addressing two zero-day vulnerabilities that are being used to attack iPhones , iPads and Macs .
On April 7, Apple issued emergency security updates to fix two weaknesses that are being actively exploited, including CVE-2023-28206 , which can be exploited by apps to seize control over a device. CVE-2023-28205 can be used by a malicious or hacked website to install code.
Both vulnerabilities are addressed in iOS/iPadOS 16.4.1, iOS 15.7.5, and macOS 12.6.5 and 11.7.6 . If you use Apple devices and you don’t have automatic upda
Qualys
Microsoft and Adobe Patch Tuesday April 2023 Security Update Review
blogs_qualys·2023-04-12
Microsoft and Adobe Patch Tuesday April 2023 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for April 2023
Adobe Patches for April 2023
Zero-day Vulnerability Patched in April Patch Tuesday Edition
Other Critical Severity Vulnerabilities Patched in April Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
Qualys Monthly Webinar Series
This Month in Vulnerabilities & Patches
Microsoft released security updates to address 114 vulnerabilities in the April Patch Tuesday edition. The security advisories cover various vul
Talos
Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
blogs_talos·2023-04-11·CVSS 7.8
CVE-2023-28252 [HIGH] Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
Microsoft released its monthly round of security updates and patches today, continuing its trend of fixing zero-day vulnerabilities on Patch Tuesday.
April's security update includes one vulnerability that’s actively being exploited in the wild. There are also eight critical vulnerabilities and the remaining 90 are considered “important.”
CVE-2023-28252 , an elevation of privilege vulnerability in the Windows Common Log File System Driver, is actively being exploited in the wild, according to Microsoft, though proof of concept code is not currently available. An adversary could exploit this vulnerability to gain SYSTEM privileges.
The U.S. Cybersecurity and Infrastructure Security Agency already added
Talos
Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
blogs_talos·2023-04-11·CVSS 7.8
CVE-2023-28252 [HIGH] Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities
Microsoft released its monthly round of security updates and patches today, continuing its trend of fixing zero-day vulnerabilities on Patch Tuesday.
April's security update includes one vulnerability that’s actively being exploited in the wild. There are also eight critical vulnerabilities and the remaining 90 are considered “important.”
CVE-2023-28252, an elevation of privilege vulnerability in the Windows Common Log File System Driver, is actively being exploited in the wild, according to Microsoft, though proof of concept code is not currently available. An adversary could exploit this vulnerability to gain SYSTEM privileges.
The U.S. Cybersecurity and Infrastructure Security Agency already added the vulnerability to its list of know exploited issues and urged federal agencies to pa
Krebs
Microsoft (& Apple) Patch Tuesday, April 2023 Edition
blogs_krebs·2023-04-11·CVSS 8.8
CVE-2023-28206 [HIGH] Microsoft (& Apple) Patch Tuesday, April 2023 Edition
Microsoft today released software updates to plug 100 security holes in its Windows operating systems and other software, including a zero-day vulnerability that is already being used in active attacks. Not to be outdone, Apple has released a set of important updates addressing two zero-day vulnerabilities that are being used to attack iPhones, iPads and Macs.
On April 7, Apple issued emergency security updates to fix two weaknesses that are being actively exploited, including CVE-2023-28206, which can be exploited by apps to seize control over a device. CVE-2023-28205 can be used by a malicious or hacked website to install code.
Both vulnerabilities are addressed in iOS/iPadOS 16.4.1, iOS 15.7.5, and macOS 12.6.5 and 11.7.6. If you use Apple devices and you don’t have automatic updates
Crowdstrike
April 2023 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] April 2023 Patch Tuesday: Updates and Analysis
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Bugzilla
CVE-2023-53853 kernel: netlink: annotate accesses to nlk->cb_running
bugzilla·2025-12-09
CVE-2023-53853 [MEDIUM] CVE-2023-53853 kernel: netlink: annotate accesses to nlk->cb_running
CVE-2023-53853 kernel: netlink: annotate accesses to nlk->cb_running
In the Linux kernel, the following vulnerability has been resolved:
netlink: annotate accesses to nlk->cb_running
Both netlink_recvmsg() and netlink_native_seq_show() read
nlk->cb_running locklessly. Use READ_ONCE() there.
Add corresponding WRITE_ONCE() to netlink_dump() and
__netlink_dump_start()
syzbot reported:
BUG: KCSAN: data-race in __netlink_dump_start / netlink_recvmsg
write to 0xffff88813ea4db59 of 1 bytes by task 28219 on cpu 0:
__netlink_dump_start+0x3af/0x4d0 net/netlink/af_netlink.c:2399
netlink_dump_start include/linux/netlink.h:308 [inline]
rtnetlink_rcv_msg+0x70f/0x8c0 net/core/rtnetlink.c:6130
netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2577
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6192
2023-04-11
Published