cbcvebase.
CVE-2023-52435
published 2024-02-20

CVE-2023-52435: In the Linux kernel, the following vulnerability has been resolved: net: prevent mss overflow in skb_segment() Once again syzbot is able to crash the kernel in…

PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.23%
14.1th percentile
In the Linux kernel, the following vulnerability has been resolved: net: prevent mss overflow in skb_segment() Once again syzbot is able to crash the kernel in skb_segment() [1] GSO_BY_FRAGS is a forbidden value, but unfortunately the following computation in skb_segment() can reach it quite easily : mss = mss * partial_segs; 65535 = 3 * 5 * 17 * 257, so many initial values of mss can lead to a bad final result. Make sure to limit segmentation so that the new mss value is smaller than GSO_BY_FRAGS. [1] general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 1 PID: 5079 Comm: syz-executor993 Not tainted 6.7.0-rc4-syzkaller-00141-g1ae4cd3cbdd0 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023 RIP: 0010:skb_segment+0x181d/0x3f30 net/core/skbuff.c:4551 Code: 83 e3 02 e9 fb ed ff ff e8 90 68 1c f9 48 8b 84 24 f8 00 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 b6 04 02 84 c0 74 08 3c 03 0f 8e 8a 21 00 00 48 8b 84 24 f8 00 RSP: 0018:ffffc900043473d0 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000010046 RCX: ffffffff886b1597 RDX: 000000000000000e RSI: ffffffff886b2520 RDI: 0000000000000070 RBP: ffffc90004347578 R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000002 R12: ffff888063202ac0 R13: 0000000000010000 R14: 000000000000ffff R15: 0000000000000046 FS: 0000555556e7e380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020010000 CR3: 0000000027ee2000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: udp6_ufo_fragment+0xa0e/0xd00 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x534/0x17e0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x290/0x610 net/core/g

Affected

25 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.82-1 (bookworm)linux 6.1.82-1 (bookworm)
linuxlinux
linuxlinux>= 3953c46c3ac7eef31a9935427371c6f54a22f1ba < 0d3ffbbf8631d6db0552f46250015648991c856f0d3ffbbf8631d6db0552f46250015648991c856f
linuxlinux>= 3953c46c3ac7eef31a9935427371c6f54a22f1ba < cd1022eaf87be8e6151435bd4df4c242c347e083cd1022eaf87be8e6151435bd4df4c242c347e083
linuxlinux>= 3953c46c3ac7eef31a9935427371c6f54a22f1ba < 8f8f185643747fbb448de6aab0efa51c679909a38f8f185643747fbb448de6aab0efa51c679909a3
linuxlinux>= 3953c46c3ac7eef31a9935427371c6f54a22f1ba < 6c53e8547687d9c767c139cd4b50af566f58c29a6c53e8547687d9c767c139cd4b50af566f58c29a
linuxlinux>= 3953c46c3ac7eef31a9935427371c6f54a22f1ba < 989b0ff35fe5fc9652ee5bafbe8483db6f27b137989b0ff35fe5fc9652ee5bafbe8483db6f27b137
linuxlinux>= 3953c46c3ac7eef31a9935427371c6f54a22f1ba < 95b3904a261a9f810205da560e802cc326f50d7795b3904a261a9f810205da560e802cc326f50d77
linuxlinux>= 3953c46c3ac7eef31a9935427371c6f54a22f1ba < 23d05d563b7e7b0314e65c8e882bc27eac2da8e723d05d563b7e7b0314e65c8e882bc27eac2da8e7
linuxlinux_kernel< 5.4.2695.4.269
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.216-15.10.216-1
linuxlinux_kernel>= 0 < 6.1.82-16.1.82-1
linuxlinux_kernel>= 0 < 6.6.11-16.6.11-1
linuxlinux_kernel>= 0 < 6.6.11-16.6.11-1
linuxlinux_kernel>= 0 < 5.4.0-181.2015.4.0-181.201
linuxlinux_kernel>= 0 < 5.15.0-106.1165.15.0-106.116
linuxlinux_kernel>= 5.11.0 < 5.15.1495.15.149
linuxlinux_kernel>= 5.16.0 < 6.1.796.1.79
linuxlinux_kernel>= 5.5.0 < 5.10.2105.10.210
linuxlinux_kernel>= 6.2.0 < 6.6.116.6.11
msrccbl2_kernel_5.15.148.2-2_on_cbl_mariner_2.0
msrccbl2_kernel_5.15.153.1-1_on_cbl_mariner_2.0
msrccbl_mariner_2.0_arm
msrccbl_mariner_2.0_x64

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.