CVE-2023-2156

A flaw was found in the Linux kernel's networking subsystem within the RPL protocol's handling. This issue results from the improper handling of user-supplied data, which can lead to an assertion failure. This flaw allows an unauthenticated, remote attacker to create a denial of service condition on the system.

Red Hat Enterprise Linux 6, 7, and 8 are not affected by this flaw as they did not include RPL source routing support (upstream commit 8610c7c "net: ipv6: add support for rpl sr exthdr"). The flaw cannot be triggered if the rpl_seg_enabled sysctl is set to 0. Please note that the rpl_seg_enabled sysctl is not enabled by default in Red Hat Enterprise Linux 9. As such, the impact has been lowered to Moderate on Red Hat Enterprise Linux 9.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.