CVE-2023-52628

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-52628
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-52628.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-52628
Downstream
Related
Published
2024-03-28T07:33:46.217Z
Modified
2026-04-11T12:46:33.719462Z
Summary
netfilter: nftables: exthdr: fix 4-byte stack OOB write
Details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nftables: exthdr: fix 4-byte stack OOB write

If priv->len is a multiple of 4, then dst[len / 4] can write past the destination array which leads to stack corruption.

This construct is necessary to clean the remainder of the register in case ->len is NOT a multiple of the register size, so make it conditional just like nft_payload.c does.

The bug was added in 4.1 cycle and then copied/inherited when tcp/sctp and ip option support was added.

Bug reported by Zero Day Initiative project (ZDI-CAN-21950, ZDI-CAN-21951, ZDI-CAN-21961).

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52628.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
49499c3e6e18b7677a63316f3ff54a16533dc28f
Fixed
28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a
Fixed
cf39c4f77a773a547ac2bcf30ecdd303bb0c80cb
Fixed
a7d86a77c33ba1c357a7504341172cc1507f0698
Fixed
1ad7b189cc1411048434e8595ffcbe7873b71082
Fixed
d9ebfc0f21377690837ebbd119e679243e0099cc
Fixed
c8f292322ff16b9a2272a67de396c09a50e09dce
Fixed
fd94d9dadee58e09b49075240fe83423eb1dcd36

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-52628.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.1.0
Fixed
4.19.316
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.279
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.198
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.132
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.54
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.5.4

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-52628.json"