CVE-2023-45871: Buffer Overflow
An issue was discovered in drivers/net/ethernet/intel/igb/igbmain.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.
Other sources
An issue was discovered in igbconfigurerxring in drivers/net/ethernet/intel/igb/igbmain.c in IGB driver in the Linux kernel. In this flaw, an attacker will need to be on the adjacent physical layer, as the data in the physical hardware maximum transmission unit (MTU) and not in the TCP protocol, and a buffer size may not be adequate for frames larger than the MTU.
Reference; https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=bb5ed01cd2428cd25b1c88a3a9cba87055eb289f
— Red Hat
Linux Kernel is vulnerable to a buffer overflow, caused by improper bounds checking by the IGB driver in drivers/net/ethernet/intel/igb/igbmain.c. By sending a specially crafted request, a remote attacker from within the local network could overflow a buffer and execute arbitrary code or cause a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-45871?
CVE-2023-45871 is an issue in the IGB driver in the Linux kernel before 6.5.3.
What is the severity of CVE-2023-45871?
The severity of CVE-2023-45871 is critical with a score of 9.8.
How does CVE-2023-45871 affect Linux?
CVE-2023-45871 affects the Linux kernel before version 6.5.3.
What is the fix for CVE-2023-45871?
To fix CVE-2023-45871, update your Linux kernel to version 6.5.3 or later.
What is the Common Weakness Enumeration (CWE) for CVE-2023-45871?
The Common Weakness Enumeration (CWE) for CVE-2023-45871 is CWE-120 (Buffer Copy without Checking Size of Input).