CVE-2023-52628

netfilter: nftables: exthdr: fix 4-byte stack OOB write

State: Published
Severity: 7.8 High
Published: Mar 28, 2024
Updated: Aug 5, 2026
Reserved: Mar 6, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nftables: exthdr: fix 4-byte stack OOB write

If priv->len is a multiple of 4, then dst[len / 4] can write past the destination array which leads to stack corruption.

This construct is necessary to clean the remainder of the register in case ->len is NOT a multiple of the register size, so make it conditional just like nft_payload.c does.

The bug was added in 4.1 cycle and then copied/inherited when tcp/sctp and ip option support was added.

Bug reported by Zero Day Initiative project (ZDI-CAN-21950, ZDI-CAN-21951, ZDI-CAN-21961).

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	49499c3e6e18b7677a63316f3ff54a16533dc28f to before 28a97c43c9e32f437ebb8d6126f9bb7f3ca9521aAffected 49499c3e6e18b7677a63316f3ff54a16533dc28f to before cf39c4f77a773a547ac2bcf30ecdd303bb0c80cbAffected 49499c3e6e18b7677a63316f3ff54a16533dc28f to before a7d86a77c33ba1c357a7504341172cc1507f0698Affected 49499c3e6e18b7677a63316f3ff54a16533dc28f to before 1ad7b189cc1411048434e8595ffcbe7873b71082Affected 49499c3e6e18b7677a63316f3ff54a16533dc28f to before d9ebfc0f21377690837ebbd119e679243e0099ccAffected 49499c3e6e18b7677a63316f3ff54a16533dc28f to before c8f292322ff16b9a2272a67de396c09a50e09dceAffected 49499c3e6e18b7677a63316f3ff54a16533dc28f to before fd94d9dadee58e09b49075240fe83423eb1dcd36Affected
LinuxLinux	4.1Affected before 4.1Not affected 4.19.316 through 4.19.Not affected 5.4.279 through 5.4.Not affected 5.10.198 through 5.10.Not affected 5.15.132 through 5.15.Not affected 6.1.54 through 6.1.Not affected 6.5.4 through 6.5.Not affected 6.6 and laterNot affected

Product

Versions

LinuxLinux

49499c3e6e18b7677a63316f3ff54a16533dc28f to before 28a97c43c9e32f437ebb8d6126f9bb7f3ca9521aAffected
49499c3e6e18b7677a63316f3ff54a16533dc28f to before cf39c4f77a773a547ac2bcf30ecdd303bb0c80cbAffected
49499c3e6e18b7677a63316f3ff54a16533dc28f to before a7d86a77c33ba1c357a7504341172cc1507f0698Affected
49499c3e6e18b7677a63316f3ff54a16533dc28f to before 1ad7b189cc1411048434e8595ffcbe7873b71082Affected
49499c3e6e18b7677a63316f3ff54a16533dc28f to before d9ebfc0f21377690837ebbd119e679243e0099ccAffected
49499c3e6e18b7677a63316f3ff54a16533dc28f to before c8f292322ff16b9a2272a67de396c09a50e09dceAffected
49499c3e6e18b7677a63316f3ff54a16533dc28f to before fd94d9dadee58e09b49075240fe83423eb1dcd36Affected

LinuxLinux

4.1Affected
before 4.1Not affected
4.19.316 through 4.19.*Not affected
5.4.279 through 5.4.*Not affected
5.10.198 through 5.10.*Not affected
5.15.132 through 5.15.*Not affected
6.1.54 through 6.1.*Not affected
6.5.4 through 6.5.*Not affected
6.6 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.