CVE-2023-53517

A flaw was found in the Linux kernel's Transparent Inter-Process Communication (TIPC) protocol. A malicious peer can exploit this by sending a specially crafted Activate message with a very small Maximum Transmission Unit (MTU) value during link MTU negotiation. This can lead to an integer overflow, causing a system crash and resulting in a Denial of Service (DoS).

A moderate-severity denial of service flaw was found in the Linux kernel's Transparent Inter-Process Communication (TIPC) implementation shipped in Red Hat Enterprise Linux 8 and 9. During TIPC link MTU negotiation, a malicious peer can send a specially crafted Activate message advertising a very small MTU value (as small as 4 bytes). Because the negotiated MTU was not validated against the bearer minimum MTU, the MSS computation underflows and produces a huge link MTU value. This causes repeated transmission failures and, through the allocation and subsequent purge of a very large socket buffer, can crash the kernel, resulting in a denial of service. There is no impact on confidentiality or integrity.

The kernel and kernel-rt packages in Red Hat Enterprise Linux 8 and 9 are affected, and the fix for these streams is currently deferred given the moderate, availability-only impact of the flaw. The residual risk on affected releases is a system crash (denial of service) on systems where TIPC is configured and in use and where an attacker is able to act as a peer in link MTU negotiation. Red Hat Enterprise Linux 6, 7, and 10, and Red Hat In-Vehicle OS, are not affected because the vulnerable code is not present in those releases.

Red Hat and NIST both rate this flaw as Moderate (CVSS 3.1 base score 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs significantly from the Critical score (9.8) in the upstream CVEORG record. Red Hat's scoring reflects the availability-only impact and the requirement that TIPC be configured and the attacker able to participate as a peer in link MTU negotiation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the tipc kernel module from loading by creating a blacklist file. This may impact functionality that relies on TIPC.

Create a file named /etc/modprobe.d/blacklist-tipc.conf with the following content:

blacklist tipc

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect.

druncate -s 0 /etc/modprobe.d/blacklist-tipc.conf
echo "blacklist tipc" >> /etc/modprobe.d/blacklist-tipc.conf
druncate -s 0 /etc/modules-load.d/tipc.conf
mkinitrd -f /boot/initramfs-$(uname -r).img $(uname -r)
reboot

Warning: A system reboot is required for the mitigation to be fully applied and to ensure the module is not loaded.