cbcvebase.
CVE-2023-52796
published 2024-05-21

CVE-2023-52796: In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlan_route_v6_outbound() helper Inspired by syzbot reports using a stack of…

PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.25%
15.8th percentile
In the Linux kernel, the following vulnerability has been resolved: ipvlan: add ipvlan_route_v6_outbound() helper Inspired by syzbot reports using a stack of multiple ipvlan devices. Reduce stack size needed in ipvlan_process_v6_outbound() by moving the flowi6 struct used for the route lookup in an non inlined helper. ipvlan_route_v6_outbound() needs 120 bytes on the stack, immediately reclaimed. Also make sure ipvlan_process_v4_outbound() is not inlined. We might also have to lower MAX_NEST_DEV, because only syzbot uses setups with more than four stacked devices. BUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000) stack guard page: 0000 [#1] SMP KASAN CPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 RIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188 Code: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89 RSP: 0018:ffffc9000e804000 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568 RBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c R13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000 FS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: [] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 [] instrument_atomic_read include/linux/instrumented.h:72 [inline] [] _test_bit include/asm-generic/bit

Affected

22 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.64-1 (bookworm)linux 6.1.64-1 (bookworm)
linuxlinux
linuxlinux>= 2ad7bf3638411cb547f2823df08166c13ab04269 < 4f7f850611aa27aaaf1bf5687702ad2240ae442a4f7f850611aa27aaaf1bf5687702ad2240ae442a
linuxlinux>= 2ad7bf3638411cb547f2823df08166c13ab04269 < 4d2d30f0792b47908af64c4d02ed1ee25ff505424d2d30f0792b47908af64c4d02ed1ee25ff50542
linuxlinux>= 2ad7bf3638411cb547f2823df08166c13ab04269 < 43b781e7cb5cd0b435de276111953bf2bacd1f0243b781e7cb5cd0b435de276111953bf2bacd1f02
linuxlinux>= 2ad7bf3638411cb547f2823df08166c13ab04269 < 1f64cad3ac38ac5978b53c40e6c5e6fd3477c68f1f64cad3ac38ac5978b53c40e6c5e6fd3477c68f
linuxlinux>= 2ad7bf3638411cb547f2823df08166c13ab04269 < 732a67ca436887b594ebc43bb5a04ffb0971a760732a67ca436887b594ebc43bb5a04ffb0971a760
linuxlinux>= 2ad7bf3638411cb547f2823df08166c13ab04269 < 8872dc638c24bb774cd2224a69d72a7f661a4d568872dc638c24bb774cd2224a69d72a7f661a4d56
linuxlinux>= 2ad7bf3638411cb547f2823df08166c13ab04269 < 03cddc4df8c6be47fd27c8f8b87e5f9a989e145803cddc4df8c6be47fd27c8f8b87e5f9a989e1458
linuxlinux>= 2ad7bf3638411cb547f2823df08166c13ab04269 < 18f039428c7df183b09c69ebf10ffd4e521035d218f039428c7df183b09c69ebf10ffd4e521035d2
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.205-15.10.205-1
linuxlinux_kernel>= 0 < 6.1.64-16.1.64-1
linuxlinux_kernel>= 0 < 6.6.8-16.6.8-1
linuxlinux_kernel>= 0 < 6.6.8-16.6.8-1
linuxlinux_kernel>= 3.19 < 4.19.3004.19.300
linuxlinux_kernel>= 4.20 < 5.4.2625.4.262
linuxlinux_kernel>= 5.11 < 5.15.1405.15.140
linuxlinux_kernel>= 5.16 < 6.1.646.1.64
linuxlinux_kernel>= 5.5 < 5.10.2025.10.202
linuxlinux_kernel>= 6.2 < 6.5.136.5.13
linuxlinux_kernel>= 6.6 < 6.6.36.6.3

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.