CVE-2023-2860

What it actually does

The vulnerability is an out-of-bounds read in the Linux kernel SR-IPv6 implementation during seg6 attribute processing, caused by missing validation of user-supplied data that allows reading past the end of an allocated buffer and disclosing kernel memory to a privileged local user.

Why it matters to the business

A local privileged attacker could extract sensitive kernel memory contents such as cryptographic keys or credentials, increasing risk of further compromise on Linux systems; the issue has remained low-risk with stable low exploit probability over three years and no known widespread exploitation.

How an attack unfolds

An attacker with high-privilege local access crafts malicious seg6 attributes for IPv6 segment routing packets and submits them to the kernel, triggering the flawed validation path that performs an out-of-bounds read and returns kernel memory contents.

How to fix it

Upgrade the Linux kernel to a patched release that corrects the seg6 attribute validation flaw; if immediate patching is not possible, restrict use of SR-IPv6 features and limit high-privilege local accounts.

How to confirm the fix worked

Confirm the running kernel version is newer than vulnerable releases, review kernel configuration for SR-IPv6 enablement, and test that crafted seg6 inputs no longer produce unauthorized memory disclosures.

Typical attack path

1. Obtain privileged local shell or process execution on an affected Linux system
2. Prepare and submit specially crafted seg6 IPv6 attributes via netlink or socket interfaces
3. Trigger the vulnerable SR-IPv6 attribute processing code path
4. Capture the leaked kernel memory returned by the out-of-bounds read

How to detect it

Review authentication and sudo logs for unexpected privileged sessions, inspect netlink and IPv6 routing configuration changes, and look for processes that interact with seg6 or segment routing sysctl settings around the time of suspected activity.

What your security team should do

• Prioritize kernel updates on all Linux hosts that support IPv6 segment routing
• Audit and minimize the set of accounts with local root or CAP_NET_ADMIN privileges
• Disable SR-IPv6 where the feature is not required
• Include kernel version checks in vulnerability scanning and asset inventory processes