In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: exthdr: fix 4-byte stack OOB write
If priv->len is a multiple of 4, then dst[len / 4] can write past the destination array which leads to stack corruption.
This construct is necessary to clean the remainder of the register in case ->len is NOT a multiple of the register size, so make it conditional just like nft_payload.c does.
The bug was added in 4.1 cycle and then copied/inherited when tcp/sctp and ip option support was added.
Bug reported by Zero Day Initiative project (ZDI-CAN-21950, ZDI-CAN-21951, ZDI-CAN-21961).
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52628.json",
"cna_assigner": "Linux"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-52628.json"
[
{
"id": "CVE-2023-52628-17d81115",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd94d9dadee58e09b49075240fe83423eb1dcd36",
"target": {
"file": "net/netfilter/nft_exthdr.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148648171174225392286438592893302644393",
"154226769119178441100019789873026672980",
"299473374020241871927496133535387726945",
"163801197331103126171227559769311272105",
"107633738547047358773913071604592298079",
"184636637892752868093425359569774628686",
"62526517944417800826704523225574951013",
"111254422834067773199140813006988621770",
"163801197331103126171227559769311272105",
"107633738547047358773913071604592298079",
"184636637892752868093425359569774628686",
"62526517944417800826704523225574951013",
"111254422834067773199140813006988621770",
"88315051996677417274576574097374441935",
"151871821604043503353129649888820152520",
"185574650831397419065087610085319136111",
"218144370715473970857873688398804180430",
"157971731002024795430899179044288359182",
"254061124523944696640845751909008840757",
"73957956798120545633061239228378963232",
"217815601828083314000167788099401178007",
"49659970140900181181256533476256619968",
"97484060032185633774706769955184032977"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2023-52628-254e2c93",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8f292322ff16b9a2272a67de396c09a50e09dce",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_sctp_eval"
},
"digest": {
"function_hash": "201496779361693710953585831833679344240",
"length": 1010.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-2bc58f30",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd94d9dadee58e09b49075240fe83423eb1dcd36",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_tcp_eval"
},
"digest": {
"function_hash": "260738103789159665274611681403036967685",
"length": 898.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-326922f5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8f292322ff16b9a2272a67de396c09a50e09dce",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_ipv4_eval"
},
"digest": {
"function_hash": "127899253027785811023116885823048608113",
"length": 668.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-36db5dd2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb",
"target": {
"file": "net/netfilter/nft_exthdr.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148648171174225392286438592893302644393",
"154226769119178441100019789873026672980",
"299473374020241871927496133535387726945",
"163801197331103126171227559769311272105",
"107633738547047358773913071604592298079",
"184636637892752868093425359569774628686",
"62526517944417800826704523225574951013",
"111254422834067773199140813006988621770",
"163801197331103126171227559769311272105",
"107633738547047358773913071604592298079",
"184636637892752868093425359569774628686",
"62526517944417800826704523225574951013",
"111254422834067773199140813006988621770",
"88315051996677417274576574097374441935",
"151871821604043503353129649888820152520",
"185574650831397419065087610085319136111",
"218144370715473970857873688398804180430"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2023-52628-40435b4a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d9ebfc0f21377690837ebbd119e679243e0099cc",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_ipv4_eval"
},
"digest": {
"function_hash": "127899253027785811023116885823048608113",
"length": 668.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-55b4ee82",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ad7b189cc1411048434e8595ffcbe7873b71082",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_sctp_eval"
},
"digest": {
"function_hash": "201496779361693710953585831833679344240",
"length": 1010.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-58dc06ce",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ad7b189cc1411048434e8595ffcbe7873b71082",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_ipv4_eval"
},
"digest": {
"function_hash": "127899253027785811023116885823048608113",
"length": 668.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-644c486e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd94d9dadee58e09b49075240fe83423eb1dcd36",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_ipv6_eval"
},
"digest": {
"function_hash": "67289379916583681183448774132010840732",
"length": 656.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-6c96166c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a",
"target": {
"file": "net/netfilter/nft_exthdr.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148648171174225392286438592893302644393",
"154226769119178441100019789873026672980",
"299473374020241871927496133535387726945",
"163801197331103126171227559769311272105",
"107633738547047358773913071604592298079",
"184636637892752868093425359569774628686",
"62526517944417800826704523225574951013",
"111254422834067773199140813006988621770",
"88315051996677417274576574097374441935",
"151871821604043503353129649888820152520",
"185574650831397419065087610085319136111",
"218144370715473970857873688398804180430"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2023-52628-7bef69f3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_ipv6_eval"
},
"digest": {
"function_hash": "67289379916583681183448774132010840732",
"length": 656.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-803197d5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7d86a77c33ba1c357a7504341172cc1507f0698",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_ipv4_eval"
},
"digest": {
"function_hash": "127899253027785811023116885823048608113",
"length": 668.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-80855b11",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d9ebfc0f21377690837ebbd119e679243e0099cc",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_tcp_eval"
},
"digest": {
"function_hash": "260738103789159665274611681403036967685",
"length": 898.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-85d9c2ae",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_ipv4_eval"
},
"digest": {
"function_hash": "127899253027785811023116885823048608113",
"length": 668.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-8606cb50",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7d86a77c33ba1c357a7504341172cc1507f0698",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_tcp_eval"
},
"digest": {
"function_hash": "260738103789159665274611681403036967685",
"length": 898.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-92e94ee9",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7d86a77c33ba1c357a7504341172cc1507f0698",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_sctp_eval"
},
"digest": {
"function_hash": "201496779361693710953585831833679344240",
"length": 1010.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-ae43d568",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d9ebfc0f21377690837ebbd119e679243e0099cc",
"target": {
"file": "net/netfilter/nft_exthdr.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148648171174225392286438592893302644393",
"154226769119178441100019789873026672980",
"299473374020241871927496133535387726945",
"163801197331103126171227559769311272105",
"107633738547047358773913071604592298079",
"184636637892752868093425359569774628686",
"62526517944417800826704523225574951013",
"111254422834067773199140813006988621770",
"163801197331103126171227559769311272105",
"107633738547047358773913071604592298079",
"184636637892752868093425359569774628686",
"62526517944417800826704523225574951013",
"111254422834067773199140813006988621770",
"88315051996677417274576574097374441935",
"151871821604043503353129649888820152520",
"185574650831397419065087610085319136111",
"218144370715473970857873688398804180430",
"157971731002024795430899179044288359182",
"254061124523944696640845751909008840757",
"73957956798120545633061239228378963232",
"217815601828083314000167788099401178007",
"49659970140900181181256533476256619968",
"97484060032185633774706769955184032977"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2023-52628-af602a64",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8f292322ff16b9a2272a67de396c09a50e09dce",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_tcp_eval"
},
"digest": {
"function_hash": "260738103789159665274611681403036967685",
"length": 898.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-b1f939a5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ad7b189cc1411048434e8595ffcbe7873b71082",
"target": {
"file": "net/netfilter/nft_exthdr.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148648171174225392286438592893302644393",
"154226769119178441100019789873026672980",
"299473374020241871927496133535387726945",
"163801197331103126171227559769311272105",
"107633738547047358773913071604592298079",
"184636637892752868093425359569774628686",
"62526517944417800826704523225574951013",
"111254422834067773199140813006988621770",
"163801197331103126171227559769311272105",
"107633738547047358773913071604592298079",
"184636637892752868093425359569774628686",
"62526517944417800826704523225574951013",
"111254422834067773199140813006988621770",
"88315051996677417274576574097374441935",
"151871821604043503353129649888820152520",
"185574650831397419065087610085319136111",
"218144370715473970857873688398804180430",
"157971731002024795430899179044288359182",
"254061124523944696640845751909008840757",
"73957956798120545633061239228378963232",
"217815601828083314000167788099401178007",
"49659970140900181181256533476256619968",
"97484060032185633774706769955184032977"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2023-52628-c3258073",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8f292322ff16b9a2272a67de396c09a50e09dce",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_ipv6_eval"
},
"digest": {
"function_hash": "67289379916583681183448774132010840732",
"length": 656.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-c62e35df",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_ipv6_eval"
},
"digest": {
"function_hash": "96997688621151144289466598194243029696",
"length": 649.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-c75a0ecd",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ad7b189cc1411048434e8595ffcbe7873b71082",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_tcp_eval"
},
"digest": {
"function_hash": "260738103789159665274611681403036967685",
"length": 898.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-c91c629c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd94d9dadee58e09b49075240fe83423eb1dcd36",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_ipv4_eval"
},
"digest": {
"function_hash": "127899253027785811023116885823048608113",
"length": 668.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-cbd0e4e2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d9ebfc0f21377690837ebbd119e679243e0099cc",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_sctp_eval"
},
"digest": {
"function_hash": "201496779361693710953585831833679344240",
"length": 1010.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-d4b1daaa",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_tcp_eval"
},
"digest": {
"function_hash": "260738103789159665274611681403036967685",
"length": 898.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-ddf84e0f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7d86a77c33ba1c357a7504341172cc1507f0698",
"target": {
"file": "net/netfilter/nft_exthdr.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148648171174225392286438592893302644393",
"154226769119178441100019789873026672980",
"299473374020241871927496133535387726945",
"163801197331103126171227559769311272105",
"107633738547047358773913071604592298079",
"184636637892752868093425359569774628686",
"62526517944417800826704523225574951013",
"111254422834067773199140813006988621770",
"163801197331103126171227559769311272105",
"107633738547047358773913071604592298079",
"184636637892752868093425359569774628686",
"62526517944417800826704523225574951013",
"111254422834067773199140813006988621770",
"88315051996677417274576574097374441935",
"151871821604043503353129649888820152520",
"185574650831397419065087610085319136111",
"218144370715473970857873688398804180430",
"157971731002024795430899179044288359182",
"254061124523944696640845751909008840757",
"73957956798120545633061239228378963232",
"217815601828083314000167788099401178007",
"49659970140900181181256533476256619968",
"97484060032185633774706769955184032977"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2023-52628-e97de927",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c8f292322ff16b9a2272a67de396c09a50e09dce",
"target": {
"file": "net/netfilter/nft_exthdr.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"148648171174225392286438592893302644393",
"154226769119178441100019789873026672980",
"299473374020241871927496133535387726945",
"163801197331103126171227559769311272105",
"107633738547047358773913071604592298079",
"184636637892752868093425359569774628686",
"62526517944417800826704523225574951013",
"111254422834067773199140813006988621770",
"163801197331103126171227559769311272105",
"107633738547047358773913071604592298079",
"184636637892752868093425359569774628686",
"62526517944417800826704523225574951013",
"111254422834067773199140813006988621770",
"88315051996677417274576574097374441935",
"151871821604043503353129649888820152520",
"185574650831397419065087610085319136111",
"218144370715473970857873688398804180430",
"157971731002024795430899179044288359182",
"254061124523944696640845751909008840757",
"73957956798120545633061239228378963232",
"217815601828083314000167788099401178007",
"49659970140900181181256533476256619968",
"97484060032185633774706769955184032977"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line"
},
{
"id": "CVE-2023-52628-e9f6fe14",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_tcp_eval"
},
"digest": {
"function_hash": "260738103789159665274611681403036967685",
"length": 898.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-f25e9fbf",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fd94d9dadee58e09b49075240fe83423eb1dcd36",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_sctp_eval"
},
"digest": {
"function_hash": "201496779361693710953585831833679344240",
"length": 1010.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-f318e50d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d9ebfc0f21377690837ebbd119e679243e0099cc",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_ipv6_eval"
},
"digest": {
"function_hash": "67289379916583681183448774132010840732",
"length": 656.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-f5b20919",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ad7b189cc1411048434e8595ffcbe7873b71082",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_ipv6_eval"
},
"digest": {
"function_hash": "67289379916583681183448774132010840732",
"length": 656.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
},
{
"id": "CVE-2023-52628-fdc44ff2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a7d86a77c33ba1c357a7504341172cc1507f0698",
"target": {
"file": "net/netfilter/nft_exthdr.c",
"function": "nft_exthdr_ipv6_eval"
},
"digest": {
"function_hash": "67289379916583681183448774132010840732",
"length": 656.0
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function"
}
]