CVE-2023-3773: Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-07-25 · updated 2026-10-14
Weakness: CWE-125

Description

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.

Affected products

Debian Linux: 10.0, 12.0
Fedoraproject Fedora: all versions
Linux kernel: all versions
Red Hat Enterprise Linux: 8.0, 9.0

References

https://access.redhat.com/errata/RHSA-2023:6583
https://access.redhat.com/security/cve/CVE-2023-3773
https://bugzilla.redhat.com/show_bug.cgi?id=2218944
https://access.redhat.com/errata/RHSA-2023:6583
https://access.redhat.com/security/cve/CVE-2023-3773
https://bugzilla.redhat.com/show_bug.cgi?id=2218944
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
https://www.debian.org/security/2023/dsa-5492
https://cert-portal.siemens.com/productcert/html/ssa-794697.html

Get alerted when CVE-2023-3773 or the next vulnerability affects your stack