Log in Start free

Vulnerability · Published Sep 22, 2023 · Assigned by XEN

CVE-2023-34319Linux: buffer overrun in netback due to unusual packet

High 7.8

In plain English

A high-severity out-of-bounds write in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 78.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The fix for XSA-423 added logic to Linux'es netback driver to deal with a frontend splitting a packet in a way such that not all of the headers would come in one piece. Unfortunately the logic introduced there didn't account for the extreme case of the entire packet being split into as many pieces as permitted by the protocol, yet still being smaller than the area that's specially dealt with to keep all (possible) headers together. Such an unusual packet would therefore trigger a buffer overrun in the driver.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.24xen0ALPINE-CVE-2023-34319
Debian:12linux6.1.52-1DEBIAN-CVE-2023-34319
Debian:12linux6.1.52-1DSA-5492-1
Debian:13linux6.4.11-1DEBIAN-CVE-2023-34319
Debian:14linux6.4.11-1DEBIAN-CVE-2023-34319
Ubuntu:22.04:LTSlinux5.15.0-87.97UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux5.15.0-87.97USN-6446-1
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-aws5.15.0-1048.53UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-aws5.15.0-1048.53USN-6446-1
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-aws-6.26.2.0-1014.14~22.04.1USN-6444-1
Ubuntu:22.04:LTSlinux-aws-6.26.2.0-1014.14~22.04.1UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-azure5.15.0-1050.57UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-azure5.15.0-1050.57USN-6446-1
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-azure-6.26.2.0-1015.15~22.04.1USN-6444-1
Ubuntu:22.04:LTSlinux-azure-6.26.2.0-1015.15~22.04.1UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1050.57.1USN-6446-1
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1050.57.1UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-azure-fde-6.26.2.0-1015.15~22.04.1.1USN-6444-1
Ubuntu:22.04:LTSlinux-azure-fde-6.26.2.0-1015.15~22.04.1.1UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-gcp5.15.0-1045.53UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-gcp5.15.0-1045.53USN-6446-1
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-gcp-6.26.2.0-1017.19~22.04.1UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-gcp-6.26.2.0-1017.19~22.04.1USN-6444-1
Ubuntu:22.04:LTSlinux-gke5.15.0-1045.50UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-gke5.15.0-1045.50USN-6446-1
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1031.37UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1031.37USN-6446-1
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-hwe-6.26.2.0-35.35~22.04.1UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-hwe-6.26.2.0-35.35~22.04.1USN-6444-1
Ubuntu:22.04:LTSlinux-ibm5.15.0-1041.44UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-ibm5.15.0-1041.44USN-6446-1
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1043.49USN-6445-1
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1043.49UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-kvm5.15.0-1045.50UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-kvm5.15.0-1045.50USN-6446-1
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-87.96USN-6446-1
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-87.96UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.26.2.0-1015.15~22.04.1UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.26.2.0-1015.15~22.04.1USN-6444-1
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1039.39UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1039.39USN-6446-1
Ubuntu:22.04:LTSlinux-nvidia-6.26.2.0-1011.11USN-6466-1
Ubuntu:22.04:LTSlinux-nvidia-6.26.2.0-1011.11UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1019.19UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1006.6UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-oem-6.16.1.0-1021.21USN-6343-1
Ubuntu:22.04:LTSlinux-oem-6.16.1.0-1021.21UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-oracle5.15.0-1046.52UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-oracle5.15.0-1046.52USN-6446-1
Ubuntu:22.04:LTSlinux-raspi5.15.0-1041.44USN-6446-1
Ubuntu:22.04:LTSlinux-raspi5.15.0-1041.44UBUNTU-CVE-2023-34319
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-starfive-6.26.2.0-1007.8~22.04.1UBUNTU-CVE-2023-34319
Ubuntu:22.04:LTSlinux-starfive-6.26.2.0-1007.8~22.04.1USN-6444-2
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1025.29UBUNTU-CVE-2023-34319

Affected products (as reported)

VendorProductVersions
Linux Linux see references

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References