CVE-2023-52340

What it actually does

The IPv6 route cache in net/ipv6/route.c allows an attacker to exhaust the max_size threshold by repeatedly sending crafted IPv6 packets through a raw socket, causing subsequent route lookups to fail and producing network unreachable errors.

Why it matters to the business

IPv6 connectivity on affected Linux systems becomes unreliable or completely unavailable, disrupting services that rely on IPv6 and forcing fallback to IPv4 or complete loss of network access until the system is restarted or patched.

How an attack unfolds

An attacker opens a raw IPv6 socket on a reachable host and enters a tight loop that transmits specially constructed IPv6 packets. Each packet consumes an entry in the route cache until the max_size limit is reached, after which legitimate IPv6 traffic begins receiving network unreachable errors. No authentication or special privileges are required.

How to fix it

Upgrade the Linux kernel to a version that includes commit 457391b0380335d5e9a5babdec90ac53928b23b4 or later. Rebuild and reboot all affected hosts. Where immediate patching is not possible, restrict raw socket creation via seccomp, AppArmor, or SELinux policies and consider disabling IPv6 on systems that do not require it.

How to confirm the fix worked

Verify the running kernel contains commit 457391b0380335d5e9a5babdec90ac53928b23b4 or a later equivalent. Confirm that repeated raw-socket IPv6 traffic no longer causes route cache exhaustion or network unreachable errors. Monitor route cache statistics under /proc/net/ipv6_route for sustained growth under load.

Typical attack path

1. Identify a Linux system running a kernel older than the fixed commit that exposes IPv6.
2. Open a raw IPv6 socket from an unprivileged process or container.
3. Send a continuous stream of minimal IPv6 packets in a tight loop.
4. Observe route cache exhaustion and resulting network unreachable errors for all IPv6 destinations.
5. Maintain the loop to keep the denial-of-service condition active.

How to detect it

Review system logs for repeated IPv6 route cache warnings or network unreachable messages under high packet rates. Correlate with processes that have created raw IPv6 sockets. Examine /proc/net/sockstat and route cache counters for sudden spikes that coincide with service outages.

What your security team should do

• Apply the kernel update containing commit 457391b0380335d5e9a5babdec90ac53928b23b4 to all production systems within the next maintenance window.
• Harden raw socket usage with mandatory access controls on any remaining unpatched hosts.
• Add kernel version checks to vulnerability scanning and asset inventory processes.
• Test IPv6 failover behavior after patching to ensure service continuity.