CVE-2023-42755

What it actually does

Out-of-bounds read in the rsvp_classify function when the xprt pointer exceeds the linear portion of an skb in the IPv4 RSVP classifier, resulting in a kernel crash.

Why it matters to the business

Local denial-of-service that can crash affected Linux systems and interrupt services; the issue has been public for over three years with an available exploit but very low exploitation probability and no ransomware usage.

How an attack unfolds

An attacker with local access sends crafted network traffic or invokes the RSVP classifier in a way that forces the xprt pointer beyond the skb linear buffer, triggering the out-of-bounds read and kernel panic.

How to fix it

Upgrade the Linux kernel to the commit 457391b0380335d5e9a5babdec90ac53928b23b4 or later; apply the patch from the stable kernel trees that contain this fix.

How to confirm the fix worked

Verify the running kernel contains commit 457391b0380335d5e9a5babdec90ac53928b23b4; attempt to reproduce the classifier path with known-good traffic and confirm no crash occurs.

Typical attack path

1. Obtain a local shell or user account on a vulnerable Linux system
2. Trigger the IPv4 RSVP classifier with malicious input that causes the xprt pointer to exceed skb linear data
3. Observe kernel oops or panic resulting in denial of service

How to detect it

Search kernel logs and crash dumps for oops or panic messages referencing rsvp_classify or the RSVP classifier; look for unexpected system reboots correlated with local user activity involving network classification.

• rsvp_classify
• xprt pointer beyond linear skb
• kernel panic in RSVP classifier

What your security team should do

• Apply the kernel commit fix to all affected systems as soon as practical
• Confirm systems are running a patched kernel version
• Monitor kernel logs for rsvp_classify related oops messages until patching is complete