CVE-2023-32726

What it actually does

Improper validation of RDLENGTH field in DNS server responses allows a buffer overflow in the Linux kernel DNS handling code.

Why it matters to the business

Systems running affected Debian and Ubuntu kernels face risk of remote code execution or denial of service, potentially leading to full system compromise, data loss, or service outages across many downstream Linux deployments.

How an attack unfolds

An attacker intercepts or supplies a malicious DNS response containing an RDLENGTH value that exceeds the allocated buffer size, triggering memory corruption that may be leveraged for code execution or crashes.

How to fix it

Upgrade to fixed kernel versions: Debian 11 to 5.10.84-1, Debian 12/13 to 5.14.12-1, Ubuntu 20.04 packages to the listed 5.15.0 or 5.4.0 variants (e.g., linux-aws-5.15 to 5.15.0-1014.18~20.04.1), and Ubuntu 22.04 packages to 5.15.0-17.17 or 6.5.0-1008.8~22.04.1 equivalents.

How to confirm the fix worked

Confirm installed kernel package versions match or exceed the per-distribution fixed releases and test DNS resolution under controlled conditions.

Typical attack path

1. Position to deliver a crafted DNS response (via MITM, compromised resolver, or direct server control)
2. Send DNS reply with RDLENGTH set to cause buffer overflow
3. Trigger vulnerable parsing path in kernel DNS code
4. Achieve memory corruption for RCE or denial of service

How to detect it

Review kernel logs and DNS resolver activity for crashes or anomalous responses; no widespread exploitation artifacts have been publicly documented.

What your security team should do

• Apply kernel updates to all listed affected packages immediately
• Prioritize internet-facing or high-value systems given 1033 days since disclosure
• Restrict untrusted DNS traffic until patches are deployed