PT-2023-8725 · Linux+2 · Linux Kernel+2

Syzbot · Published 2023-09-18 · Updated 2025-09-29 · CVE-2023-52577

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.0

Description The vulnerability is related to the dccp v4 err and dccp v6 err functions in the Linux kernel. It is caused by an uninitialized value in the pskb may pull reason and pskb may pull functions, which can lead to a bug in the dccp v6 err function. The vulnerability can be exploited by an attacker to gain unauthorized access to sensitive information. The issue is related to the handling of ICMP messages and the allocation of memory for socket buffers.

Recommendations To resolve the issue, update the Linux kernel to version 6.6.0 or later. If an update is not possible, consider disabling the dccp v4 err and dccp v6 err functions as a temporary workaround. Additionally, restrict access to the vulnerable module to minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

Use of Uninitialized Resource

Weakness Enumeration

CWE-200

CWE-908

Related Identifiers

ALSA-2025_16880

ALT-PU-2023-8487

BDU:2024-01753

CVE-2023-52577

OESA-2024-1482

Affected Products

Alt Linux

Linux Kernel

Red Os

References · 66

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52577.json · Exploit
• https://git.kernel.org/stable/c/a6f4d582e25d512c9b492670b6608436694357b3 · Patch
• https://git.kernel.org/stable/c/73be49248a04746096339a48a33fa2f03bd85969 · Patch
• https://security-tracker.debian.org/tracker/CVE-2023-52577 · Vendor Advisory
• https://git.kernel.org/stable/c/1512d8f45d3c5d0b5baa00bd8e600492fa569f40 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-52515 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52530 · Security Note
• https://git.kernel.org/stable/c/62c218124fe58372e0e1f60d5b634d21c264b337 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-52525 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-52577 · Security Note
• https://git.kernel.org/stable/c/4600beae416d754a3cedbb1ecea8181ec05073b6 · Patch
• https://osv.dev/vulnerability/OESA-2024-1482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-52500 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52573 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52577 · Security Note