cbcvebase.
CVE-2023-42754
published 2023-10-05

CVE-2023-42754: A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling…

medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system.

Affected

19 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.55-1 (bookworm)linux 6.1.55-1 (bookworm)
fedoraprojectfedora
fedoraprojectfedora
fedoraprojectfedora
linuxlinux_kernel< 6.66.6
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.197-15.10.197-1
linuxlinux_kernel>= 0 < 6.1.55-16.1.55-1
linuxlinux_kernel>= 0 < 6.5.6-16.5.6-1
linuxlinux_kernel>= 0 < 6.5.6-16.5.6-1
linuxlinux_kernel>= 0 < 5.4.0-169.1875.4.0-169.187
linuxlinux_kernel>= 0 < 5.15.0-91.1015.15.0-91.101
linuxlinux_kernel>= 0 < 4.4.0-248.2824.4.0-248.282
linuxlinux_kernel>= 0 < 4.15.0-220.2314.15.0-220.231
msrccbl2_kernel_5.15.135.1-2_on_cbl_mariner_2.0
redhatenterprise_linux
redhatenterprise_linux
ubuntulinux-gcp
ubuntulinux-kvm

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv6.0MEDIUM