CVE-2023-23455

What it actually does

Type confusion in atm_tc_enqueue allows non-negative numbers to be misinterpreted as TC_ACT_SHOT, leading to improper packet handling and denial of service in the Linux kernel ATM scheduler.

Why it matters to the business

Local denial-of-service conditions can interrupt network traffic processing and cause system instability on affected Linux deployments, increasing operational downtime risk in environments relying on ATM queuing.

How an attack unfolds

An attacker with local access crafts input that triggers the type confusion in sch_atm.c, causing the kernel to treat valid classification results as a drop action and panic or hang the system; no remote or unauthenticated vectors are present and no named threat actors have been observed exploiting it.

How to fix it

Update the Linux kernel to commit a2965c7be0522eaa18808684b7b82b248515511b or later; apply the patch that resolves the type confusion in net/sched/sch_atm.c and rebuild or install the fixed kernel package for the distribution in use.

How to confirm the fix worked

Confirm the running kernel contains commit a2965c7be0522eaa18808684b7b82b248515511b via git log or kernel version string; test that ATM scheduler enqueue paths no longer accept ambiguous non-negative return values as drop conditions.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Trigger the ATM TC enqueue path via crafted traffic classification or module interaction
3. Supply values that exploit the non-negative vs TC_ACT_SHOT confusion
4. Induce kernel panic or service degradation

How to detect it

Review kernel logs for oops or panic entries referencing atm_tc_enqueue or sch_atm; correlate with local process activity that interacts with traffic control or ATM interfaces; no widespread exploitation artifacts have been published.

What your security team should do

• Prioritize kernel updates on systems exposing ATM or traffic-control functionality
• Restrict local user privileges where ATM queuing is enabled
• Monitor for kernel oops or panic logs related to sch_atm after any remaining exposure window