CVE-2023-52700

What it actually does

Missing iov_iter direction initialization in TIPC SYN/ACK message construction triggers _copy_from_iter sanity checks, producing kernel stack traces during tipc_msg_build and __tipc_sendmsg.

Why it matters to the business

TIPC-based clustering or messaging on affected Linux kernels can generate warnings or instability, potentially disrupting high-availability setups that rely on the protocol.

How an attack unfolds

An attacker initiates a TIPC connection that triggers a SYN message without payload; the missing iterator direction flag causes the kernel sanity check added in commit a41dad905e5a to fail and emit a stack trace.

How to fix it

Upgrade the Linux kernel to a version containing commit 54b6082aec178f16ad6d193b4ecdc9c4823d9a32 or later; rebuild and reboot with the patched tree.

How to confirm the fix worked

Verify the running kernel contains commit 54b6082aec17, reproduce a TIPC SYN without data, and confirm absence of the _copy_from_iter warning in dmesg.

Typical attack path

1. Establish network reachability to a TIPC listener
2. Send a connect request that results in a zero-length SYN
3. Trigger tipc_connect path leading to __tipc_sendmsg and tipc_msg_build
4. Observe kernel warning from _copy_from_iter

How to detect it

Search kernel logs and dmesg for the _copy_from_iter stack trace involving tipc_msg_build and __tipc_sendmsg; correlate with TIPC connection attempts.

• _copy_from_iter+0xb4/0x550
• tipc_msg_build+0x12c/0x670 [tipc]
• __tipc_sendmsg+0x2d1/0x710 [tipc]
• tipc_connect+0x1d9/0x230 [tipc]

What your security team should do

• Apply the referenced upstream commit to all TIPC-enabled kernel builds
• Prioritize systems using TIPC for cluster communication
• Monitor kernel logs for the described stack trace until patches are deployed