CVE-2023-1206: Medium severity Linux Linux kernel vulnerability
A flaw in the Linux Kernel found in the Linux kernel’s networking stack which permits attackers to force hash collisions in the IPv6 connection lookup table. This results in a significant increase in the cost of lookups, causing increased CPU utilization. This significant CPU usage increase in the Linux kernel subjected to a modified form of the classic IPv6 SYN-Flood. The actual impact of this issue may be a denial of service (due to heightened CPU usage) to hosts which can receive malicious IPv6 traffic.
Other sources
A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of SYN flood attack. A user located in the local network or with a high bandwidth connection can increase the CPU usage of the server that accepts IPV6 connections up to 95%.
— Launchpad
Linux Kernel is vulnerable to a denial of service, caused by a flaw in the IPv6 connection lookup table. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause the CPU usage to increase, and results in a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1206?
CVE-2023-1206 is considered a high-severity vulnerability due to its potential to significantly increase CPU utilization.
How do I fix CVE-2023-1206?
To mitigate CVE-2023-1206, update your Linux kernel to version 6.5 or later.
Which systems are affected by CVE-2023-1206?
CVE-2023-1206 affects several systems, including Red Hat Enterprise Linux versions 8.0 and 9.0, as well as the Linux kernel prior to version 6.5.
What impact does CVE-2023-1206 have on system performance?
CVE-2023-1206 can lead to increased CPU utilization due to forced hash collisions in the IPv6 connection lookup table.
Is there a workaround for CVE-2023-1206?
There are currently no known workarounds for CVE-2023-1206, so updating the kernel is the recommended action.