CVE-2023-2156

A flaw was found in the Linux kernel's networking subsystem within the RPL protocol's handling. This issue results from the improper handling of user-supplied data, which can lead to an assertion failure. This flaw allows an unauthenticated, remote attacker to create a denial of service condition on the system.

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Linux Kernel. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of the RPL protocol. The issue results from the lack of proper handling of user-supplied data, which can result in an assertion failure. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.

This update for the Linux Kernel 5.14.21-150400_24_46 fixes several issues. The following security issues were fixed. Fixed a use-after-free in Netfilter nf_tables when processing batch requests. Fixed a flaw in the networking subsystem within the handling of the RPL protocol. Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c. Fixed an out-of-bounds memory access flaw in nft_byteorder that could allow a local attacker to escalate their privilege. Fixed a type confusion in pick_next_rt_entity, that could cause memory corruption. Fixed an out-of-boundary read in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA. Fixed a heap out-of-bounds write in the ipvlan network driver.