CVE-2023-3812

Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags

Description

An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Remediation

Workaround:

To mitigate this issue, prevent the tun module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.

Categories

7.8

CVSS

Severity: High

CVSS 3.1 •

EPSS 0.01%

Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory redhat.com

Affected: Red Hat Red Hat Enterprise Linux 8

Affected: Red Hat Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Affected: Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support

Affected: Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Affected: Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

Affected: Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

Affected: Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Affected: Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Affected: Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support

Affected: Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support

Affected: Red Hat Red Hat Enterprise Linux 9

Affected: Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support

Affected: Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support

Affected: Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8

Affected: Red Hat Red Hat Enterprise Linux 6

Affected: Red Hat Red Hat Enterprise Linux 7

Affected: Red Hat Red Hat Enterprise Linux 9

References

Link	Tags
https://access.redhat.com/errata/RHSA-2023:6799	vendor advisory third party advisory vdb entry
https://access.redhat.com/errata/RHSA-2023:6813	vendor advisory third party advisory vdb entry
https://access.redhat.com/errata/RHSA-2023:7370	vendor advisory third party advisory vdb entry
https://access.redhat.com/errata/RHSA-2023:7379	vendor advisory third party advisory vdb entry
https://access.redhat.com/errata/RHSA-2023:7382	vendor advisory third party advisory vdb entry
https://access.redhat.com/errata/RHSA-2023:7389	vendor advisory third party advisory vdb entry
https://access.redhat.com/errata/RHSA-2023:7411	vendor advisory third party advisory vdb entry
https://access.redhat.com/errata/RHSA-2023:7418	vendor advisory third party advisory vdb entry
https://access.redhat.com/errata/RHSA-2023:7548	vendor advisory third party advisory vdb entry
https://access.redhat.com/errata/RHSA-2023:7549	vendor advisory third party advisory vdb entry
https://access.redhat.com/errata/RHSA-2023:7554	vendor advisory third party advisory vdb entry
https://access.redhat.com/errata/RHSA-2024:0340	vendor advisory
https://access.redhat.com/errata/RHSA-2024:0378	vendor advisory
https://access.redhat.com/errata/RHSA-2024:0412	vendor advisory
https://access.redhat.com/errata/RHSA-2024:0461	vendor advisory
https://access.redhat.com/errata/RHSA-2024:0554	vendor advisory
https://access.redhat.com/errata/RHSA-2024:0562	vendor advisory
https://access.redhat.com/errata/RHSA-2024:0563	vendor advisory
https://access.redhat.com/errata/RHSA-2024:0575	vendor advisory
https://access.redhat.com/errata/RHSA-2024:0593	vendor advisory
https://access.redhat.com/errata/RHSA-2024:1961	vendor advisory
https://access.redhat.com/errata/RHSA-2024:2006	vendor advisory
https://access.redhat.com/errata/RHSA-2024:2008	vendor advisory
https://access.redhat.com/security/cve/CVE-2023-3812	third party advisory vdb entry
https://bugzilla.redhat.com/show_bug.cgi?id=2224048	patch third party advisory issue tracking
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=363a5328f4b0	patch

Frequently Asked Questions

What is the severity of CVE-2023-3812?: CVE-2023-3812 has been scored as a high severity vulnerability.
How to fix CVE-2023-3812?: As a workaround for remediating CVE-2023-3812: To mitigate this issue, prevent the tun module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Is CVE-2023-3812 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2023-3812 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-3812?: CVE-2023-3812 affects Red Hat Red Hat Enterprise Linux 8, Red Hat Red Hat Enterprise Linux 8, Red Hat Red Hat Enterprise Linux 8, Red Hat Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions, Red Hat Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions, Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service, Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions, Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service, Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Red Hat Enterprise Linux 9, Red Hat Red Hat Enterprise Linux 9, Red Hat Red Hat Enterprise Linux 9, Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support, Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Red Hat Enterprise Linux 6, Red Hat Red Hat Enterprise Linux 7, Red Hat Red Hat Enterprise Linux 7, Red Hat Red Hat Enterprise Linux 9.

Description

Remediation

Categories

CWE-787 – Out-of-bounds Write

CWE-416 – Use After Free

References

Frequently Asked Questions