CVE-2023-52881
published 2024-05-29CVE-2023-52881: In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed report and…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.62%
46.1th percentile
In the Linux kernel, the following vulnerability has been resolved:
tcp: do not accept ACK of bytes we never sent
This patch is based on a detailed report and ideas from Yepeng Pan
and Christian Rossow.
ACK seq validation is currently following RFC 5961 5.2 guidelines:
The ACK value is considered acceptable only if
it is in the range of ((SND.UNA - MAX.SND.WND) SND.NXT) then send an
ACK, drop the segment, and return". The "ignored" above implies that
the processing of the incoming data segment continues, which means
the ACK value is treated as acceptable. This mitigation makes the
ACK check more stringent since any ACK bytes_acked was added in linux-4.2
Following packetdrill test (courtesy of Yepeng Pan) shows
the issue at hand:
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
+0 bind(3, ..., ...) = 0
+0 listen(3, 1024) = 0
// ---------------- Handshake ------------------- //
// when window scale is set to 14 the window size can be extended to
// 65535 * (2^14) = 1073725440. Linux would accept an ACK packet
// with ack number in (Server_ISN+1-1073725440. Server_ISN+1)
// ,though this ack number acknowledges some data never
// sent by the server.
+0
+0 > S. 0:0(0) ack 1
+0 . 1:1(0) ack 1001
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.69-1 (bookworm) | linux 6.1.69-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 3.0.58 < 3.1 | 3.1 |
| linux | linux | >= 3.2.37 < 3.3 | 3.3 |
| linux | linux | >= 3.4.25 < 3.5 | 3.5 |
| linux | linux | >= 354e4aa391ed50a4d827ff6fc11e0667d0859b25 < 69eae75ca5255e876628ac5cee9eaab31f644b57 | 69eae75ca5255e876628ac5cee9eaab31f644b57 |
| linux | linux | >= 354e4aa391ed50a4d827ff6fc11e0667d0859b25 < 458f07ffeccd17f99942311e09ef574ddf4a414a | 458f07ffeccd17f99942311e09ef574ddf4a414a |
| linux | linux | >= 354e4aa391ed50a4d827ff6fc11e0667d0859b25 < 7ffff0cc929fdfc62a74b384c4903d6496c910f0 | 7ffff0cc929fdfc62a74b384c4903d6496c910f0 |
| linux | linux | >= 354e4aa391ed50a4d827ff6fc11e0667d0859b25 < b17a886ed29f3b70b78ccf632dad03e0c69e3c1a | b17a886ed29f3b70b78ccf632dad03e0c69e3c1a |
| linux | linux | >= 354e4aa391ed50a4d827ff6fc11e0667d0859b25 < 0d4e0afdd6658cd21dd5be61880411a2553fd1fc | 0d4e0afdd6658cd21dd5be61880411a2553fd1fc |
| linux | linux | >= 354e4aa391ed50a4d827ff6fc11e0667d0859b25 < 008b807fe487e0b15a3a6c39add4eb477f73e440 | 008b807fe487e0b15a3a6c39add4eb477f73e440 |
| linux | linux | >= 354e4aa391ed50a4d827ff6fc11e0667d0859b25 < 2087d53a66e97a5eb5d1bf558d5bef9e5f891757 | 2087d53a66e97a5eb5d1bf558d5bef9e5f891757 |
| linux | linux | >= 354e4aa391ed50a4d827ff6fc11e0667d0859b25 < 3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 | 3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.205-1 | 5.10.205-1 |
| linux | linux_kernel | >= 0 < 6.1.69-1 | 6.1.69-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 3.0.58 < 3.1 | 3.1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC OS
cisa_ics·2025-08-14
Siemens SINEC OS
ICS Advisory
##
Siemens SINEC OS
Release DateAugust 14, 2025
Alert CodeICSA-25-226-15
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3.1 9.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM, SCALANCE
- Vulnerabilities: NULL Pointer Dereference, Use After Free, Unchecked Input for Loop Condition, Out-of-bounds Write, Ou
Red Hat
kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number
vendor_redhat·2024-05-01·CVSS 5.5
CVE-2023-52881 [MEDIUM] kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number
kernel: TCP-spoofed ghost ACKs and leak leak initial sequence number
In the Linux kernel, the following vulnerability has been resolved:
tcp: do not accept ACK of bytes we never sent
This patch is based on a detailed report and ideas from Yepeng Pan
and Christian Rossow.
ACK seq validation is currently following RFC 5961 5.2 guidelines:
The ACK value is considered acceptable only if
it is in the range of ((SND.UNA - MAX.SND.WND) SND.NXT) then send an
ACK, drop the segment, and return". The "ignored" above implies that
the processing of the incoming data segment continues, which means
the ACK value is treated as acceptable. This mitigation makes the
ACK check more stringent since any ACK bytes_acked was added in linux-4.2
Following packetdrill test (courtesy of Yepeng Pan) shows
the issue
Debian
CVE-2023-52881: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: do not...
vendor_debian·2023·CVSS 5.5
CVE-2023-52881 [MEDIUM] CVE-2023-52881: linux - In the Linux kernel, the following vulnerability has been resolved: tcp: do not...
In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow. ACK seq validation is currently following RFC 5961 5.2 guidelines: The ACK value is considered acceptable only if it is in the range of ((SND.UNA - MAX.SND.WND) SND.NXT) then send an ACK, drop the segment, and return". The "ignored" above implies that the processing of the incoming data segment continues, which means the ACK value is treated as acceptable. This mitigation makes the ACK check more stringent since any ACK bytes_acked was added in linux-4.2 Following packetdrill test (courtesy of Yepeng Pan) shows the issue at hand: 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3,
OSV
CVE-2023-52881: In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed re
osv·2024-05-29·CVSS 5.5
CVE-2023-52881 [MEDIUM] CVE-2023-52881: In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed re
In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow. ACK seq validation is currently following RFC 5961 5.2 guidelines: The ACK value is considered acceptable only if it is in the range of ((SND.UNA - MAX.SND.WND) SND.NXT) then send an ACK, drop the segment, and return". The "ignored" above implies that the processing of the incoming data segment continues, which means the ACK value is treated as acceptable. This mitigation makes the ACK check more stringent since any ACK bytes_acked was added in linux-4.2 Following packetdrill test (courtesy of Yepeng Pan) shows the issue at hand: 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3,
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/008b807fe487e0b15a3a6c39add4eb477f73e440https://git.kernel.org/stable/c/0d4e0afdd6658cd21dd5be61880411a2553fd1fchttps://git.kernel.org/stable/c/2087d53a66e97a5eb5d1bf558d5bef9e5f891757https://git.kernel.org/stable/c/3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27https://git.kernel.org/stable/c/458f07ffeccd17f99942311e09ef574ddf4a414ahttps://git.kernel.org/stable/c/69eae75ca5255e876628ac5cee9eaab31f644b57https://git.kernel.org/stable/c/7ffff0cc929fdfc62a74b384c4903d6496c910f0https://git.kernel.org/stable/c/b17a886ed29f3b70b78ccf632dad03e0c69e3c1ahttps://git.kernel.org/stable/c/008b807fe487e0b15a3a6c39add4eb477f73e440https://git.kernel.org/stable/c/0d4e0afdd6658cd21dd5be61880411a2553fd1fchttps://git.kernel.org/stable/c/2087d53a66e97a5eb5d1bf558d5bef9e5f891757https://git.kernel.org/stable/c/3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27https://git.kernel.org/stable/c/458f07ffeccd17f99942311e09ef574ddf4a414ahttps://git.kernel.org/stable/c/69eae75ca5255e876628ac5cee9eaab31f644b57https://git.kernel.org/stable/c/7ffff0cc929fdfc62a74b384c4903d6496c910f0https://git.kernel.org/stable/c/b17a886ed29f3b70b78ccf632dad03e0c69e3c1a
2024-05-29
Published