PT-2025-40224 · Linux+1 · Linux Kernel+1

Published 2023-05-14 · Updated 2025-11-24 · CVE-2023-53517

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3.0.neta

Description The Linux kernel contains a flaw in the tipc (Trusted Inter-Process Communication) subsystem related to Maximum Transmission Unit (MTU) negotiation. A malicious peer could potentially send an Activate message with a very small MTU value, leading to an integer overflow when calculating the minimum MTU. This could result in excessive memory allocation and potentially a system crash, specifically a general protection fault. The issue arises from a lack of validation of the received MTU against a minimum acceptable value. The vulnerability is triggered during link MTU negotiation, where a small MTU value can cause an overflow in tipc link mss(). This can lead to warnings about large messages being purged and, in severe cases, a kernel crash during message transmission. The affected function is tipc link xmit().

Recommendations Update the Linux kernel to version 6.3.0.neta or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2025-12908

CVE-2023-53517

RHSA-2023:6583

RHSA-2023:7077

SUSE-SU-2025:4189-1

Affected Products

Linux Kernel

Suse

References · 311

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53517.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-53517 · Vendor Advisory
• https://git.kernel.org/stable/c/56077b56cd3fb78e1c8619e29581ba25a5c55e86 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-53517 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-53517 · Security Note
• https://git.kernel.org/stable/c/2bd4ff4ffb92113f8acd04dbaed83269172c24b4 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2023-53517 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12908 · Security Note
• https://ubuntu.com/security/CVE-2023-53517 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-53517 · Vendor Advisory
• https://git.kernel.org/stable/c/575e84d90a74c0b091b3417ba763ebb237aa0a8c · Patch
• https://osv.dev/vulnerability/CVE-2023-53517 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4189-1 · Vendor Advisory
• https://git.kernel.org/stable/c/1dd7ae5e0cf5a56e513f7ab7ab9570b7496281d2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-53517 · Security Note