PT-2023-31041 · Katran · Katran

Publicado 2023-11-28 · Atualizado 2023-12-04 · CVE-2023-49062

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Katran versions prior to commit 6a03106ac1eab39d0303662963589ecb2374c97f

Description The issue allows Katran to disclose non-initialized kernel memory as part of an IP header. This occurs in IPv4 encapsulation and ICMP (v4) Too Big packet generation. After a bpf xdp adjust head call, the Katran code fails to initialize the Identification field for the IPv4 header, resulting in the writing of kernel memory content in that field of the IP header.

Recommendations For all versions prior to commit 6a03106ac1eab39d0303662963589ecb2374c97f, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of IPv4 encapsulation and ICMP (v4) Too Big packet generation until a patch is available.

Correção

Improper Initialization

Enumeração de Fraquezas

CWE-665

Identificadores relacionados

CVE-2023-49062

Produtos afetados

Katran

Referências · 6

• https://github.com/facebookincubator/katran/commit/6a03106ac1eab39d0303662963589ecb2374c97f · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-49062 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-49062 · Aviso do Fabricante
• https://t.me/cvenotify/61338 · Publicação no Telegram
• https://t.me/cvenotify/62179 · Publicação no Telegram
• https://facebook.com/security/advisories/cve-2023-49062 · Aviso do Fabricante