CVE-2023-0394

What it actually does

NULL pointer dereference in rawv6_push_pending_frames within the Linux kernel IPv6 raw socket handling path triggers an immediate kernel panic and system crash.

Why it matters to the business

Linux systems experience unexpected downtime and loss of availability when local users trigger the affected network code path, requiring reboots and potentially disrupting services until the kernel is updated.

How an attack unfolds

An attacker with local access crafts specific IPv6 raw socket operations that reach the vulnerable pending-frames function, causing the kernel to dereference a NULL pointer and panic the system.

How to fix it

Update the Linux kernel to a version containing commit cb3e9864cdbe35ff6378966660edbcbac955fe17 or later; apply the latest vendor kernel packages that include the fix.

How to confirm the fix worked

Confirm the running kernel contains commit cb3e9864cdbe35ff6378966660edbcbac955fe17; verify absence of the vulnerable rawv6_push_pending_frames code path via source inspection or kernel version checks against fixed releases.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Open an IPv6 raw socket and perform operations that queue pending frames
3. Trigger the code path in rawv6_push_pending_frames to induce the NULL dereference
4. Observe resulting kernel panic and system reboot

How to detect it

Inspect kernel logs and dmesg output for oops or panic messages referencing net/ipv6/raw.c or the rawv6_push_pending_frames function; correlate with recent local user activity involving IPv6 sockets.

What your security team should do

• Prioritize kernel updates on all exposed Linux systems within standard patch cycles
• Monitor vendor advisories for backported fixes in supported distributions
• Restrict untrusted local user access where possible until patches are applied