CVE-2023-42754: Kernel: ipv4: null pointer dereference in ipv4_send_dest_unreach()
A flaw was found in ipv4senddestunreach() due to NULL pointer derefence due to a missing edge-case check.
Other sources
A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling ipoptionscompile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAPNETADMIN privileges to crash the system.
— Launchpad
Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference flaw in the ipv4senddestunreach function in net/ipv4/route.c. By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6 - Configuration
If unprivileged user namespaces are not needed, disable them by setting kernel.unprivileged_userns_clone=0. Apply temporarily with `sudo sysctl -w kernel.unprivileged_userns_clone=0`; to persist across reboots, write `kernel.unprivileged_userns_clone=0` to `/etc/sysctl.d/99-disable-unpriv-userns.conf`.
Linux kernel kernel.unprivileged_userns_clone = 0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-42754?
CVE-2023-42754 has been categorized as a medium severity vulnerability.
How do I fix CVE-2023-42754?
To fix CVE-2023-42754, update the Linux kernel or the specific affected packages to versions that include the patch.
Which systems are affected by CVE-2023-42754?
CVE-2023-42754 affects various versions of the Linux kernel up to 6.6 and specific releases of Red Hat Enterprise Linux, Fedora, and Debian.
What causes the vulnerability in CVE-2023-42754?
CVE-2023-42754 is caused by a NULL pointer dereference in the ipv4_send_dest_unreach() function due to a missing edge-case check.
Is there a workaround for CVE-2023-42754?
There is no documented workaround for CVE-2023-42754; upgrading to a fixed version is the recommended approach.