CVE-2023-3090
📋 TL;DR
This CVE describes a heap out-of-bounds write vulnerability in the Linux Kernel's ipvlan network driver that allows local attackers to escalate privileges. The vulnerability occurs due to missing skb->cb initialization and affects systems with CONFIG_IPVLAN enabled. Attackers with local access can exploit this to gain root privileges on vulnerable systems.
💻 Affected Systems
- Linux Kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains full root privileges, leading to complete system compromise, data theft, and persistent backdoor installation.
Likely Case
Local user or compromised service escalates to root, enabling lateral movement, credential harvesting, and further system exploitation.
If Mitigated
With proper access controls and minimal local user accounts, impact is limited but still allows privilege escalation for any local user.
🎯 Exploit Status
Exploitation requires local access and CONFIG_IPVLAN enabled. No public exploit code has been disclosed as of the available references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel with commit 90cbed5247439a966b645b34eb0a2e037836ea8e or later
Vendor Advisory: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=90cbed5247439a966b645b34eb0a2e037836ea8e
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing commit 90cbed5247439a966b645b34eb0a2e037836ea8e. 2. Check distribution-specific security advisories for patched kernel packages. 3. Reboot system after kernel update.
🔧 Temporary Workarounds
Disable ipvlan module
linuxPrevent loading of the vulnerable ipvlan kernel module
echo 'install ipvlan /bin/false' >> /etc/modprobe.d/disable-ipvlan.conf
rmmod ipvlan 2>/dev/null || true
Blacklist ipvlan module
linuxBlacklist the ipvlan module to prevent automatic loading
echo 'blacklist ipvlan' >> /etc/modprobe.d/blacklist-ipvlan.conf
🧯 If You Can't Patch
- Restrict local user access to minimize attack surface
- Implement strict SELinux/AppArmor policies to limit privilege escalation
🔍 How to Verify
Check if Vulnerable:
Check if ipvlan module is loaded: lsmod | grep ipvlan. Check kernel version against patched versions.Check Version:
uname -rVerify Fix Applied:
Verify kernel version includes commit 90cbed5247439a966b645b34eb0a2e037836ea8e: git log --oneline | grep 90cbed5247439a966b645b34eb0a2e037836ea8e📡 Detection & Monitoring
Log Indicators:
- Kernel panic or oops messages related to ipvlan
- Unexpected privilege escalation events in audit logs
Network Indicators:
- Unusual network activity from ipvlan interfaces
SIEM Query:
source="kernel" AND "ipvlan" AND ("panic" OR "oops" OR "segfault")🔗 References
- http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html
- http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=90cbed5247439a966b645b34eb0a2e037836ea8e
- https://kernel.dance/90cbed5247439a966b645b34eb0a2e037836ea8e
- https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
- https://security.netapp.com/advisory/ntap-20230731-0002/
- https://www.debian.org/security/2023/dsa-5448
- https://www.debian.org/security/2023/dsa-5480
- http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html
- http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=90cbed5247439a966b645b34eb0a2e037836ea8e
- https://kernel.dance/90cbed5247439a966b645b34eb0a2e037836ea8e
- https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
- https://security.netapp.com/advisory/ntap-20230731-0002/
- https://www.debian.org/security/2023/dsa-5448
- https://www.debian.org/security/2023/dsa-5480
