OESA-2024-1175 (CVE-2023-46838)

Vulnerability from osv_openeuler – Published: 2024-02-23 11:06 – Updated: 2026-08-06 11:06 – Source website
VLAI
Summary
kernel security update
Details

The Linux Kernel, the operating system core itself.

Security Fix(es):

Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial portion of the to be transferred data, these parts are directly translated into what Linux calls SKB fragments. Such converted request parts can, when for a particular SKB they are all of length zero, lead to a de-reference of NULL in core networking code. (CVE-2023-46838)

A flaw in the routing table size was found in the ICMPv6 handling of "Packet Too Big". The size of the routing table is regulated by periodic garbage collection. However, with "Packet Too Big Messages" it is possible to exceed the routing table size and garbage collector threshold. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.(CVE-2023-52340)

A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.(CVE-2024-0639)

A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.(CVE-2024-0841)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.

We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

(CVE-2024-1086)

In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access.(CVE-2024-23849)

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "kernel-debugsource-5.10.0-136.64.0.144.oe2203sp1.aarch64.rpm",
          "kernel-tools-5.10.0-136.64.0.144.oe2203sp1.aarch64.rpm",
          "kernel-source-5.10.0-136.64.0.144.oe2203sp1.aarch64.rpm",
          "kernel-headers-5.10.0-136.64.0.144.oe2203sp1.aarch64.rpm",
          "kernel-5.10.0-136.64.0.144.oe2203sp1.aarch64.rpm",
          "perf-debuginfo-5.10.0-136.64.0.144.oe2203sp1.aarch64.rpm",
          "kernel-tools-debuginfo-5.10.0-136.64.0.144.oe2203sp1.aarch64.rpm",
          "kernel-debuginfo-5.10.0-136.64.0.144.oe2203sp1.aarch64.rpm",
          "kernel-devel-5.10.0-136.64.0.144.oe2203sp1.aarch64.rpm",
          "python3-perf-5.10.0-136.64.0.144.oe2203sp1.aarch64.rpm",
          "perf-5.10.0-136.64.0.144.oe2203sp1.aarch64.rpm",
          "kernel-tools-devel-5.10.0-136.64.0.144.oe2203sp1.aarch64.rpm",
          "python3-perf-debuginfo-5.10.0-136.64.0.144.oe2203sp1.aarch64.rpm"
        ],
        "src": [
          "kernel-5.10.0-136.64.0.144.oe2203sp1.src.rpm"
        ],
        "x86_64": [
          "perf-debuginfo-5.10.0-136.64.0.144.oe2203sp1.x86_64.rpm",
          "kernel-tools-debuginfo-5.10.0-136.64.0.144.oe2203sp1.x86_64.rpm",
          "kernel-tools-devel-5.10.0-136.64.0.144.oe2203sp1.x86_64.rpm",
          "kernel-headers-5.10.0-136.64.0.144.oe2203sp1.x86_64.rpm",
          "python3-perf-debuginfo-5.10.0-136.64.0.144.oe2203sp1.x86_64.rpm",
          "python3-perf-5.10.0-136.64.0.144.oe2203sp1.x86_64.rpm",
          "kernel-debuginfo-5.10.0-136.64.0.144.oe2203sp1.x86_64.rpm",
          "perf-5.10.0-136.64.0.144.oe2203sp1.x86_64.rpm",
          "kernel-debugsource-5.10.0-136.64.0.144.oe2203sp1.x86_64.rpm",
          "kernel-5.10.0-136.64.0.144.oe2203sp1.x86_64.rpm",
          "kernel-source-5.10.0-136.64.0.144.oe2203sp1.x86_64.rpm",
          "kernel-tools-5.10.0-136.64.0.144.oe2203sp1.x86_64.rpm",
          "kernel-devel-5.10.0-136.64.0.144.oe2203sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP1",
        "name": "kernel",
        "purl": "pkg:rpm/openEuler/kernel\u0026distro=openEuler-22.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.10.0-136.64.0.144.oe2203sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nTransmit requests in Xen\u0026apos;s virtual network protocol can consist of\nmultiple parts.  While not really useful, except for the initial part\nany of them may be of zero length, i.e. carry no data at all.  Besides a\ncertain initial portion of the to be transferred data, these parts are\ndirectly translated into what Linux calls SKB fragments.  Such converted\nrequest parts can, when for a particular SKB they are all of length\nzero, lead to a de-reference of NULL in core networking code.\n(CVE-2023-46838)\r\n\r\nA flaw in the routing table size was found in the ICMPv6 handling of \u0026quot;Packet Too Big\u0026quot;. The size of the routing table is regulated by periodic garbage collection. However, with \u0026quot;Packet Too Big Messages\u0026quot; it is possible to exceed the routing table size and garbage collector threshold. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.(CVE-2023-52340)\r\n\r\nA denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel\u2019s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.(CVE-2024-0639)\r\n\r\nA null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.(CVE-2024-0841)\r\n\r\nA use-after-free vulnerability in the Linux kernel\u0026apos;s netfilter: nf_tables component can be exploited to achieve local privilege escalation.\r\n\r\nThe nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT.\r\n\r\nWe recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.\r\n\r\n(CVE-2024-1086)\r\n\r\nIn rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access.(CVE-2024-23849)",
  "id": "OESA-2024-1175",
  "modified": "2026-08-06T11:06:37Z",
  "published": "2024-02-23T11:06:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1175"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46838"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52340"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0639"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0841"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1086"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23849"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kernel security update",
  "upstream": [
    "CVE-2023-46838",
    "CVE-2023-52340",
    "CVE-2024-0639",
    "CVE-2024-0841",
    "CVE-2024-1086",
    "CVE-2024-23849"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.