CVE-2023-1390

What it actually does

The flaw triggers an unbounded while loop in tipc_link_xmit() when the TIPC module receives two crafted UDP packets on a UDP bearer, causing the kernel to spin at 100% CPU utilization and producing a remote denial of service.

Why it matters to the business

Systems running the vulnerable kernel with TIPC UDP bearers enabled become unresponsive, interrupting network services and requiring manual reboot or power cycle, which can halt dependent workloads until the kernel is updated.

How an attack unfolds

An attacker sends two small, specially formed UDP packets to a listening UDP bearer on a system that has loaded the TIPC module; the packets drive the transmit path into an unknown SKB state, causing the while loop to spin indefinitely and exhaust the CPU.

How to fix it

Upgrade the Linux kernel to the commit b77413446408fdd256599daf00d5be72b5f3e7c6 or later; disable the TIPC module (modprobe.blacklist=tipc) or block UDP traffic on TIPC bearer ports until the update can be applied.

How to confirm the fix worked

Confirm the running kernel contains commit b77413446408fdd256599daf00d5be72b5f3e7c6; attempt to load the TIPC module and send the two-packet sequence in a lab environment to verify the loop no longer occurs.

Typical attack path

1. Identify hosts exposing a TIPC UDP bearer on the network
2. Craft and transmit two minimal UDP packets targeting the bearer port
3. Observe immediate CPU saturation and loss of responsiveness on the target
4. Maintain the condition with repeated packets or simply leave the system in DoS state

How to detect it

Review system and kernel logs for sudden sustained 100% CPU usage on TIPC-related threads immediately after inbound UDP traffic; correlate with network flow records showing two small UDP packets to TIPC bearer ports.

What your security team should do

• Prioritize kernel updates on all systems that expose TIPC UDP bearers
• Apply the blacklist or firewall rules as an immediate compensating control
• Scan inventories for any hosts still running kernels before the cited commit
• Monitor EPSS and KEV status for any future change in exploit availability