First published: Sat Jan 09 2021(Updated: )
A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition.
Credit: secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/kernel-rt | <0:4.18.0-305.rt7.72.el8 | 0:4.18.0-305.rt7.72.el8 |
redhat/kernel | <0:4.18.0-305.el8 | 0:4.18.0-305.el8 |
redhat/kernel | <0:4.18.0-147.83.1.el8_1 | 0:4.18.0-147.83.1.el8_1 |
redhat/kernel | <0:4.18.0-193.109.1.el8_2 | 0:4.18.0-193.109.1.el8_2 |
redhat/kernel-rt | <0:4.18.0-193.109.1.rt13.160.el8_2 | 0:4.18.0-193.109.1.rt13.160.el8_2 |
redhat/kernel | <5.11 | 5.11 |
Linux Kernel | >=4.3<4.9.253 | |
Linux Kernel | >=4.10<4.14.217 | |
Linux Kernel | >=4.15<4.19.170 | |
Linux Kernel | >=4.20<5.4.92 | |
Linux Kernel | >=5.5<5.10.10 | |
Linux Kernel | =5.11-rc1 | |
Linux Kernel | =5.11-rc2 | |
Linux Kernel | =5.11-rc3 | |
debian/linux | 5.10.223-1 5.10.226-1 6.1.123-1 6.1.119-1 6.12.11-1 6.12.12-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
The severity of CVE-2023-1390 is classified as high due to the potential for remote denial of service.
To fix CVE-2023-1390, update your kernel to the specified versions that contain the security patch.
CVE-2023-1390 affects several versions of the Linux kernel, specifically those prior to 4.18.0-305.el8.
Exploitation of CVE-2023-1390 may lead to increased CPU utilization, causing system performance degradation.
A potential workaround for CVE-2023-1390 is to limit UDP traffic to the affected system until an update can be applied.