Denial of Service Vulnerability in Linux Kernel IPv6 Implementation
Summary
CVE-2023-52340: The IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold that can be consumed easily, e.g., leading to a denial of service (network is unreachable errors) when IPv6 packets are sen... Affects linux versions < 5.10.209-1. Fixed in 5.10.209-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It supports various networking protocols, including IPv6, which is crucial for modern internet connectivity. The kernel's IPv6 implementation is designed to handle network traffic efficiently, but it is susceptible to specific vulnerabilities that can lead to service disruptions.
Vulnerability Detail
The vulnerability identified as CVE-2023-52340 affects the IPv6 implementation in the Linux kernel versions prior to 6.3. It involves a max_size threshold in the net/ipv6/route.c file that can be easily exploited. Attackers can send IPv6 packets in a loop via a raw socket, resulting in denial of service due to network unreachable errors. This can severely impact network availability and performance, making systems vulnerable to disruptions.
How To Fix
Minimum fixed version
5.10.209-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of raw sockets or implement network filtering rules to mitigate the impact of the vulnerability until the kernel is updated. This can be done using iptables or similar firewall tools to restrict traffic that could exploit the vulnerability.
Conclusion
CVE-2023-52340 is a significant vulnerability in the Linux kernel's IPv6 implementation that can lead to denial of service. Users are advised to upgrade their kernel to the latest fixed versions to mitigate the risk. Temporary workarounds can be employed, but updating is the most effective solution.
See every vulnerability recorded for linux →
FAQ
CVE-2023-52340 is a vulnerability in the Linux kernel's IPv6 implementation that can lead to denial of service.
The vulnerability affects Linux kernel versions prior to 6.3.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check your application without signup.
Exploitation of this vulnerability can lead to network unreachable errors, causing denial of service and affecting system availability.
The CVSS score for CVE-2023-52340 is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.