CVE-2023-3107

Remote denial of service in IPv6 fragment reassembly

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

A set of carefully crafted ipv6 packets can trigger an integer overflow in the calculation of a fragment reassembled packet's payload length field. This allows an attacker to trigger a kernel panic, resulting in a denial of service.

Un conjunto de paquetes ipv6 cuidadosamente diseñados puede desencadenar un desbordamiento de enteros en el cálculo del campo de longitud de la carga útil de un paquete reensamblado por fragmentos. Esto permite a un atacante desencadenar un kernel panic, resultando en una denegación de servicio.

*Credits: Zweig of Kunlun Lab

CVSS Scores

NISTv3.1 7.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

None

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-06-05 CVE Reserved
2023-08-01 CVE Published
2024-09-02 EPSS Updated
2024-10-22 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-190: Integer Overflow or Wraparound

CAPEC

CAPEC-128: Integer Attacks

References (2)

URL	Tag	Source
https://security.netapp.com/advisory/ntap-20230804-0001	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://security.FreeBSD.org/advisories/FreeBSD-SA-23:06.ipv6.asc	2023-08-07

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				12.4 Search vendor "Freebsd" for product "Freebsd" and version "12.4"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				12.4 Search vendor "Freebsd" for product "Freebsd" and version "12.4"		p1		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				12.4 Search vendor "Freebsd" for product "Freebsd" and version "12.4"		p2		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				12.4 Search vendor "Freebsd" for product "Freebsd" and version "12.4"		p3		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				12.4 Search vendor "Freebsd" for product "Freebsd" and version "12.4"		rc2-p1		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				12.4 Search vendor "Freebsd" for product "Freebsd" and version "12.4"		rc2-p2		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				13.1 Search vendor "Freebsd" for product "Freebsd" and version "13.1"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				13.1 Search vendor "Freebsd" for product "Freebsd" and version "13.1"		b1-p1		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				13.1 Search vendor "Freebsd" for product "Freebsd" and version "13.1"		b2-p2		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				13.1 Search vendor "Freebsd" for product "Freebsd" and version "13.1"		p1		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				13.1 Search vendor "Freebsd" for product "Freebsd" and version "13.1"		p2		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				13.1 Search vendor "Freebsd" for product "Freebsd" and version "13.1"		p3		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				13.1 Search vendor "Freebsd" for product "Freebsd" and version "13.1"		p4		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				13.1 Search vendor "Freebsd" for product "Freebsd" and version "13.1"		p5		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				13.1 Search vendor "Freebsd" for product "Freebsd" and version "13.1"		p6		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				13.1 Search vendor "Freebsd" for product "Freebsd" and version "13.1"		p7		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				13.1 Search vendor "Freebsd" for product "Freebsd" and version "13.1"		p8		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				13.1 Search vendor "Freebsd" for product "Freebsd" and version "13.1"		rc1-p1		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				13.2 Search vendor "Freebsd" for product "Freebsd" and version "13.2"		-		Affected
Freebsd Search vendor "Freebsd"		Freebsd Search vendor "Freebsd" for product "Freebsd"				13.2 Search vendor "Freebsd" for product "Freebsd" and version "13.2"		p1		Affected
Netapp Search vendor "Netapp"		Clustered Data Ontap Search vendor "Netapp" for product "Clustered Data Ontap"				9.0 Search vendor "Netapp" for product "Clustered Data Ontap" and version "9.0"		-		Affected