cbcvebase.
CVE-2023-53343
published 2025-09-17

CVE-2023-53343: In the Linux kernel, the following vulnerability has been resolved: icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). With some IPv6 Ext…

PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.19%
9.1th percentile
In the Linux kernel, the following vulnerability has been resolved: icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that has the link-local address as src and dst IP and will be forwarded to an external IP in the IPv6 Ext Hdr. For example, the script below generates a packet whose src IP is the link-local address and dst is updated to 11::. # for f in $(find /proc/sys/net/ -name *seg6_enabled*); do echo 1 > $f; done # python3 >>> from socket import * >>> from scapy.all import * >>> >>> SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456" >>> >>> pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR) >>> pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1) >>> >>> sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW) >>> sk.sendto(bytes(pkt), (DST_ADDR, 0)) For such a packet, we call ip6_route_input() to look up a route for the next destination in these three functions depending on the header type. * ipv6_rthdr_rcv() * ipv6_rpl_srh_rcv() * ipv6_srh_rcv() If no route is found, ip6_null_entry is set to skb, and the following dst_input(skb) calls ip6_pkt_drop(). Finally, in icmp6_dev(), we dereference skb_rt6_info(skb)->rt6i_idev->dev as the input device is the loopback interface. Then, we have to check if skb_rt6_info(skb)->rt6i_idev is NULL or not to avoid NULL pointer deref for ip6_null_entry. BUG: kernel NULL pointer dereference, address: 0000000000000000 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 157 Comm: python3 Not tainted 6.4.0-11996-gb121d614371c #35 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503) Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 8b 00 44 8b 88 e0 00

Affected

20 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.52-1 (bookworm)linux 6.1.52-1 (bookworm)
linuxlinux
linuxlinux>= 4832c30d5458387ff2533ff66fbde26ad8bb5a2d < 8803c59fde4dd370a627dfbf7183682fa0cabf708803c59fde4dd370a627dfbf7183682fa0cabf70
linuxlinux>= 4832c30d5458387ff2533ff66fbde26ad8bb5a2d < 61b4c4659746959056450b92a5d7e6bc1243b31b61b4c4659746959056450b92a5d7e6bc1243b31b
linuxlinux>= 4832c30d5458387ff2533ff66fbde26ad8bb5a2d < d30ddd7ff15df9d91a793ce3f06f0190ff7afaccd30ddd7ff15df9d91a793ce3f06f0190ff7afacc
linuxlinux>= 4832c30d5458387ff2533ff66fbde26ad8bb5a2d < 3fabca5d9cae0140b6aad09a1c6b9aa57089fbb83fabca5d9cae0140b6aad09a1c6b9aa57089fbb8
linuxlinux>= 4832c30d5458387ff2533ff66fbde26ad8bb5a2d < 1462e9d9aa52d14665eaca6d89d22c4af44ede041462e9d9aa52d14665eaca6d89d22c4af44ede04
linuxlinux>= 4832c30d5458387ff2533ff66fbde26ad8bb5a2d < aa657d319e6c7502a4eb85cc0ee80cc81b8e5724aa657d319e6c7502a4eb85cc0ee80cc81b8e5724
linuxlinux>= 4832c30d5458387ff2533ff66fbde26ad8bb5a2d < 2aaa8a15de73874847d62eb595c6683bface80fd2aaa8a15de73874847d62eb595c6683bface80fd
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.191-15.10.191-1
linuxlinux_kernel>= 0 < 6.1.52-16.1.52-1
linuxlinux_kernel>= 0 < 6.4.11-16.4.11-1
linuxlinux_kernel>= 0 < 6.4.11-16.4.11-1
linuxlinux_kernel>= 4.14 < 4.19.2914.19.291
linuxlinux_kernel>= 4.20 < 5.4.2515.4.251
linuxlinux_kernel>= 5.11 < 5.15.1215.15.121
linuxlinux_kernel>= 5.16 < 6.1.406.1.40
linuxlinux_kernel>= 5.5 < 5.10.1885.10.188
linuxlinux_kernel>= 6.2 < 6.4.56.4.5

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.