PT-2024-14752 · Linux+7 · Linux Kernel+7
Syzbot
·
Published
2023-11-10
·
Updated
2025-09-29
·
CVE-2023-52796
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.1.52-syzkaller
Description
The vulnerability is related to the ipvlan module in the Linux kernel. It was discovered through syzbot reports using a stack of multiple ipvlan devices. The issue arises from the need to reduce the stack size required in
ipvlan process v6 outbound() by moving the flowi6 struct used for route lookup into a non-inlined helper, ipvlan route v6 outbound(). This helper needs 120 bytes on the stack, which is immediately reclaimed. Additionally, ipvlan process v4 outbound() should not be inlined. The vulnerability might also necessitate lowering MAX NEST DEV because only syzbot uses setups with more than four stacked devices.Recommendations
To resolve the issue for Linux kernel versions prior to 6.1.52-syzkaller, update to a version that includes the fix for the ipvlan module, specifically the addition of the
ipvlan route v6 outbound() helper and ensuring ipvlan process v4 outbound() is not inlined. If updating is not immediately possible, consider temporarily disabling the use of stacked ipvlan devices to minimize the risk of exploitation.Exploit
Fix
Memory Corruption
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Almalinux
Astra Linux
Centos
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse