Vulnerability · Published Jul 25, 2023 · Assigned by redhat

CVE-2023-3772Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()

Medium 5.5

In plain English

A medium-severity null pointer dereference in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.5%top 58.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	bpftool	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-abi-stablelists	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-core	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-cross-headers	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-debug	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-debug-core	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-debug-devel	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-debug-modules	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-debug-modules-extra	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-devel	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-doc	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-headers	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-modules	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-modules-extra	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-tools	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-tools-libs	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-tools-libs-devel	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-zfcpdump	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-zfcpdump-core	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-zfcpdump-devel	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-zfcpdump-modules	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	kernel-zfcpdump-modules-extra	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	perf	4.18.0-513.5.1.el8_9	ALSA-2023:7077
AlmaLinux:8	python3-perf	4.18.0-513.5.1.el8_9	ALSA-2023:7077
Debian:12	linux	6.1.52-1	DEBIAN-CVE-2023-3772
Debian:12	linux	6.1.52-1	DSA-5492-1
Debian:13	linux	6.4.13-1	DEBIAN-CVE-2023-3772
Debian:14	linux	6.4.13-1	DEBIAN-CVE-2023-3772
Ubuntu:22.04:LTS	linux	5.15.0-88.98	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux	5.15.0-88.98	USN-6465-1
Ubuntu:22.04:LTS	linux-allwinner-5.19	no fix listed	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-aws	5.15.0-1049.54	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-aws	5.15.0-1049.54	USN-6465-1
Ubuntu:22.04:LTS	linux-aws-5.19	no fix listed	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-aws-6.2	6.2.0-1015.15~22.04.1	USN-6464-1
Ubuntu:22.04:LTS	linux-aws-6.2	6.2.0-1015.15~22.04.1	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-azure	5.15.0-1051.59	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-azure	5.15.0-1051.59	USN-6465-1
Ubuntu:22.04:LTS	linux-azure-5.19	no fix listed	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-azure-6.2	6.2.0-1016.16~22.04.1	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-azure-6.2	6.2.0-1016.16~22.04.1	USN-6464-1
Ubuntu:22.04:LTS	linux-azure-fde	5.15.0-1051.59.1	USN-6465-1
Ubuntu:22.04:LTS	linux-azure-fde	5.15.0-1051.59.1	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-azure-fde-5.19	no fix listed	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-azure-fde-6.2	6.2.0-1016.16~22.04.1.1	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-azure-fde-6.2	6.2.0-1016.16~22.04.1.1	USN-6464-1
Ubuntu:22.04:LTS	linux-gcp	5.15.0-1046.54	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-gcp	5.15.0-1046.54	USN-6465-1
Ubuntu:22.04:LTS	linux-gcp-5.19	no fix listed	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-gcp-6.2	6.2.0-1018.20~22.04.1	USN-6464-1
Ubuntu:22.04:LTS	linux-gcp-6.2	6.2.0-1018.20~22.04.1	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-gke	5.15.0-1046.51	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-gke	5.15.0-1046.51	USN-6465-3
Ubuntu:22.04:LTS	linux-gkeop	5.15.0-1032.38	USN-6465-1
Ubuntu:22.04:LTS	linux-gkeop	5.15.0-1032.38	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-hwe-5.19	no fix listed	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-hwe-6.2	6.2.0-36.37~22.04.1	USN-6464-1
Ubuntu:22.04:LTS	linux-hwe-6.2	6.2.0-36.37~22.04.1	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-ibm	5.15.0-1042.45	USN-6465-1
Ubuntu:22.04:LTS	linux-ibm	5.15.0-1042.45	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-intel-iotg	5.15.0-1045.51	USN-6516-1
Ubuntu:22.04:LTS	linux-intel-iotg	5.15.0-1045.51	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-kvm	5.15.0-1046.51	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-kvm	5.15.0-1046.51	USN-6465-1
Ubuntu:22.04:LTS	linux-lowlatency	5.15.0-88.98	USN-6465-1
Ubuntu:22.04:LTS	linux-lowlatency	5.15.0-88.98	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-lowlatency-hwe-5.19	no fix listed	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-lowlatency-hwe-6.2	6.2.0-1016.16~22.04.1	USN-6464-1
Ubuntu:22.04:LTS	linux-lowlatency-hwe-6.2	6.2.0-1016.16~22.04.1	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-nvidia	5.15.0-1040.40	USN-6465-1
Ubuntu:22.04:LTS	linux-nvidia	5.15.0-1040.40	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-nvidia-6.2	6.2.0-1011.11	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-nvidia-6.2	6.2.0-1011.11	USN-6466-1
Ubuntu:22.04:LTS	linux-nvidia-tegra	5.15.0-1019.19	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-nvidia-tegra-igx	5.15.0-1006.6	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-oem-5.17	no fix listed	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-oem-6.0	no fix listed	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-oem-6.1	6.1.0-1023.23	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-oem-6.1	6.1.0-1023.23	USN-6415-1
Ubuntu:22.04:LTS	linux-oracle	5.15.0-1047.53	USN-6465-1
Ubuntu:22.04:LTS	linux-oracle	5.15.0-1047.53	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-raspi	5.15.0-1042.45	USN-6465-2
Ubuntu:22.04:LTS	linux-raspi	5.15.0-1042.45	UBUNTU-CVE-2023-3772
Ubuntu:24.04:LTS	linux-raspi-realtime	no fix listed	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-realtime	no fix listed	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-riscv	no fix listed	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-riscv-5.19	no fix listed	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-starfive-5.19	no fix listed	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-starfive-6.2	6.2.0-1009.10~22.04.1	UBUNTU-CVE-2023-3772
Ubuntu:22.04:LTS	linux-starfive-6.2	6.2.0-1009.10~22.04.1	USN-6520-1
Ubuntu:22.04:LTS	linux-xilinx-zynqmp	5.15.0-1025.29	UBUNTU-CVE-2023-3772

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Virtualization 4 for Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 6	see references
Red Hat	Red Hat Enterprise Linux 7	see references
Red Hat	Red Hat Enterprise Linux 7	see references
Red Hat	Red Hat Enterprise Linux 9	see references

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

RHSA-2023:6583 vendor-advisory, x_refsource_REDHAT
RHSA-2023:6901 vendor-advisory, x_refsource_REDHAT
RHSA-2023:7077 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0412 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0575 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2023-3772 vdb-entry, x_refsource_REDHAT
RHBZ#2218943 issue-tracking, x_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2023/08/10/1 x_transferred
http://www.openwall.com/lists/oss-security/2023/08/10/3 x_transferred
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html x_transferred
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html x_transferred
https://www.debian.org/security/2023/dsa-5492 x_transferred
https://cert-portal.siemens.com/productcert/html/ssa-794697.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html