CVE-2023-6200
Kernel: icmpv6 router advertisement packets, aka linux tcp/ip remote code execution vulnerability
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 2.02 % · percentile 81 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution.
Weaknesses (CWE)
- CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | redhat |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-58448
- GCVE · GCVE-0-2023-6200
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*< 6.7cpe:2.3:o:linux:linux_kernel:6.7:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.7:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.7:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.7:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.7:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.7:rc6:*:*:*:*:*:*
Affected products
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |