CVE-2023-53333

What it actually does

Out-of-bounds stack read in nf_conntrack_dccp_packet when skb_header_pointer only copies the basic DCCP header, allowing dccp_ack_seq and related functions to access memory beyond the allocated buffer for extended sequence numbers and packet-type headers.

Why it matters to the business

Kernel memory corruption on systems processing DCCP traffic can cause crashes, denial of service, or limited information disclosure; low exploitability and prevalence reduce immediate operational risk for most environments.

How an attack unfolds

An attacker sends a specially crafted DCCP packet with extended headers or sequence numbers that exceed the basic header size copied to the stack buffer; the conntrack code then reads past the buffer boundary when validating or processing the packet.

How to fix it

Update the Linux kernel to commit 337fdce450637ea663bc816edc2ba81e5cdad02e or later; rebuild and deploy the fixed kernel image, then reboot affected systems. Disable DCCP conntrack if the protocol is not required.

How to confirm the fix worked

Confirm the running kernel contains commit 337fdce450637ea663bc816edc2ba81e5cdad02e; test with synthetic DCCP packets that exercise extended headers and verify absence of KASAN reports or crashes.

Typical attack path

1. Craft a DCCP packet containing extended sequence numbers or packet types requiring 48-bit fields
2. Send the packet toward a target system with DCCP conntrack enabled
3. Trigger nf_conntrack_dccp_packet to perform the undersized skb_header_pointer call
4. Read kernel stack memory beyond the _dh buffer via dccp_ack_seq or header parsing
5. Achieve KASAN-detected out-of-bounds read or attempt to leverage for further exploitation

How to detect it

Search kernel logs and audit records for KASAN stack-out-of-bounds warnings citing nf_conntrack_dccp_packet; inspect network flows for unexpected DCCP packets with non-standard header lengths or sequence number fields.

What your security team should do

• Apply the referenced kernel commit or distribution update immediately on systems exposing DCCP
• Review conntrack configuration and disable DCCP support where unused
• Monitor kernel logs for KASAN or stack-out-of-bounds reports involving nf_conntrack_dccp_packet
• Track upstream removal of DCCP conntrack support planned later in the year