CVE-2023-42754
Assigner: redhat
Published: 2023-10-05T18:25:22.372Z
State: PUBLISHED
title: Kernel: ipv4: null pointer dereference in ipv4_send_dest_unreach()
metrics: other: content: value: Moderate
namespace: https://access.redhat.com/security/updates/classification/
type: Red Hat severity rating
cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
format: CVSS
descriptions: value: A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system.
affected: vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel-rt
defaultStatus: affected
versions: version: 0:4.18.0-553.rt7.342.el8_10
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:enterprise_linux:8::nfv
cpe:/a:redhat:enterprise_linux:8::realtime
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel
defaultStatus: affected
versions: version: 0:4.18.0-553.el8_10
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:enterprise_linux:8::crb
cpe:/o:redhat:enterprise_linux:8::baseos
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel
defaultStatus: affected
versions: version: 0:5.14.0-427.13.1.el9_4
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:enterprise_linux:9::nfv
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::realtime
cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::crb
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel
defaultStatus: affected
versions: version: 0:5.14.0-427.13.1.el9_4
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:enterprise_linux:9::nfv
cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::realtime
cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/a:redhat:enterprise_linux:9::crb
vendor: Red Hat
product: Red Hat Enterprise Linux 6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:6
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:7
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel-rt
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:7
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel-rt
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:9
datePublic: 2023-09-17T00:00:00+00:00
problemTypes: descriptions: cweId: CWE-476
description: NULL Pointer Dereference
type: CWE
x_redhatCweChain: CWE-476: NULL Pointer Dereference
workarounds: value: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
timeline: time: 2023-09-13T00:00:00+00:00
value: Reported to Red Hat.
time: 2023-09-17T00:00:00+00:00
value: Made public.