CVE-2023-53782

Vulnerability

An out-of-bounds access was discovered in the DCCP error handler in the Linux kernel. A previous incomplete fix assumed only the first 8 bytes of the DCCP header were needed, but the error handler also accesses the DCCP sequence number, which is stored beyond 8 bytes. This missing pskb_may_pull() call can cause the handler to read beyond the allocated skb data [1][2][3][4].

Exploitation

An attacker can send a specially crafted DCCP packet that triggers the error handler with an insufficiently pulled header. No special privileges are required if the system has a DCCP socket available. This attack vector is network-based and can be delivered over a DCCP connection.

Impact

A successful out-of-bounds read can lead to information disclosure (leaking kernel memory) or a denial of service (kernel crash). The severity is moderate, as it requires specific packet crafting and may be mitigated by network filtering.

Mitigation

The fix has been backported to stable kernel branches in commits [1], [2], [3], [4]. Users should update to the latest kernel versions to close the vulnerability.