Vulnerability · Published Mar 16, 2023 · Assigned by redhat
CVE-2023-1390
High 7.5
In plain English
A high-severity security flaw in Linux kernel (TIPC kernel module). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.1% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packets to a system with a UDP bearer results in the CPU utilization for the system to instantly spike to 100%, causing a denial of service condition.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | linux | 5.10.12-1 | DEBIAN-CVE-2023-1390 |
| Debian:13 | linux | 5.10.12-1 | DEBIAN-CVE-2023-1390 |
| Debian:14 | linux | 5.10.12-1 | DEBIAN-CVE-2023-1390 |
| Ubuntu:22.04:LTS | linux-intel-iot-realtime | no fix listed | UBUNTU-CVE-2023-1390 |
| Ubuntu:24.04:LTS | linux-raspi-realtime | no fix listed | UBUNTU-CVE-2023-1390 |
| Ubuntu:22.04:LTS | linux-realtime | no fix listed | UBUNTU-CVE-2023-1390 |
| Ubuntu:22.04:LTS | linux-riscv | no fix listed | UBUNTU-CVE-2023-1390 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Linux kernel (TIPC kernel module) | Fixed in kernel 5.11-rc4 |
Weakness: CWE-1050 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H