目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1336 元

100%
请我们喝杯咖啡

CVE-2023-52881— Linux kernel 安全漏洞

一分钟漏洞结论

影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于TCP协议栈在处理ACK时，内核可能接受对从未发送过的字节ACK确认。

CVSS 9.8 · Critical EPSS 0.62% · P47

影响版本矩阵 24

厂商产品 版本范围状态
Linux Linux 354e4aa391ed50a4d827ff6fc11e0667d0859b25< 69eae75ca5255e876628ac5cee9eaab31f644b57 affected
354e4aa391ed50a4d827ff6fc11e0667d0859b25< 458f07ffeccd17f99942311e09ef574ddf4a414a affected
354e4aa391ed50a4d827ff6fc11e0667d0859b25< 7ffff0cc929fdfc62a74b384c4903d6496c910f0 affected
354e4aa391ed50a4d827ff6fc11e0667d0859b25< b17a886ed29f3b70b78ccf632dad03e0c69e3c1a affected
354e4aa391ed50a4d827ff6fc11e0667d0859b25< 0d4e0afdd6658cd21dd5be61880411a2553fd1fc affected
354e4aa391ed50a4d827ff6fc11e0667d0859b25< 008b807fe487e0b15a3a6c39add4eb477f73e440 affected
354e4aa391ed50a4d827ff6fc11e0667d0859b25< 2087d53a66e97a5eb5d1bf558d5bef9e5f891757 affected
354e4aa391ed50a4d827ff6fc11e0667d0859b25< 3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 affected
… +16 条更多
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2023-52881 基础信息

漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
tcp: do not accept ACK of bytes we never sent
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow. ACK seq validation is currently following RFC 5961 5.2 guidelines: The ACK value is considered acceptable only if it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= SND.NXT). All incoming segments whose ACK value doesn't satisfy the above condition MUST be discarded and an ACK sent back. It needs to be noted that RFC 793 on page 72 (fifth check) says: "If the ACK is a duplicate (SEG.ACK < SND.UNA), it can be ignored. If the ACK acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an ACK, drop the segment, and return". The "ignored" above implies that the processing of the incoming data segment continues, which means the ACK value is treated as acceptable. This mitigation makes the ACK check more stringent since any ACK < SND.UNA wouldn't be accepted, instead only ACKs that are in the range ((SND.UNA - MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through. This can be refined for new (and possibly spoofed) flows, by not accepting ACK for bytes that were never sent. This greatly improves TCP security at a little cost. I added a Fixes: tag to make sure this patch will reach stable trees, even if the 'blamed' patch was adhering to the RFC. tp->bytes_acked was added in linux-4.2 Following packetdrill test (courtesy of Yepeng Pan) shows the issue at hand: 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3 +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0 +0 listen(3, 1024) = 0 // ---------------- Handshake ------------------- // // when window scale is set to 14 the window size can be extended to // 65535 * (2^14) = 1073725440. Linux would accept an ACK packet // with ack number in (Server_ISN+1-1073725440. Server_ISN+1) // ,though this ack number acknowledges some data never // sent by the server. +0 < S 0:0(0) win 65535 <mss 1400,nop,wscale 14> +0 > S. 0:0(0) ack 1 <...> +0 < . 1:1(0) ack 1 win 65535 +0 accept(3, ..., ...) = 4 // For the established connection, we send an ACK packet, // the ack packet uses ack number 1 - 1073725300 + 2^32, // where 2^32 is used to wrap around. // Note: we used 1073725300 instead of 1073725440 to avoid possible // edge cases. // 1 - 1073725300 + 2^32 = 3221241997 // Oops, old kernels happily accept this packet. +0 < . 1:1001(1000) ack 3221241997 win 65535 // After the kernel fix the following will be replaced by a challenge ACK, // and prior malicious frame would be dropped. +0 > . 1:1(0) ack 1001
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于TCP协议栈在处理ACK时，内核可能接受对从未发送过的字节ACK确认。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD

受影响产品

厂商 产品 影响版本 CPE 订阅
Linux Linux 354e4aa391ed50a4d827ff6fc11e0667d0859b25 ~ 69eae75ca5255e876628ac5cee9eaab31f644b57 -
Linux Linux 3.8 -

二、漏洞 CVE-2023-52881 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2023-52881 的情报信息

请登录查看更多情报信息。

CVE-2023-52881 其他参考 (7)

同批安全公告 · Linux · 2024-05-29 · 共 4 条

CVE-2024-36016 7.8 HIGH Linux kernel 安全漏洞
CVE-2024-36015 Linux kernel 安全漏洞
CVE-2024-36014 Linux kernel 安全漏洞

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2023-52881

暂无评论

发表评论