Cloudanix VulnDB

CVE-2023-53477

None

CVSS

—

EPSS

0.2%

Published

Oct 1, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel calculates space for certain IPv6 network routes can cause warning messages when adding routes across multiple virtual interfaces.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Buffer Overflow
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incorrect nexthop length calculation in rt6_nlmsg_size() when fib6_info lacks lwtunnel but siblings have them, undercounting required buffer size and triggering WARNING in inet6_rt_notify() during route notification.

Why it matters to the business

IPv6 route additions involving lwtunnels on sibling interfaces can produce kernel warnings and potential route notification failures, increasing operational risk on systems using complex IPv6 configurations such as ipvlan; high ecosystem prevalence in Linux distributions amplifies exposure across servers and appliances.

How an attack unfolds

An attacker with sufficient privileges to add IPv6 routes crafts a scenario with multiple sibling routes using lwtunnel encapsulation on ipvlan-style interfaces; the undersized nlmsg triggers the warning path in inet6_rt_notify during fib6_add, though exploitation is limited to denial-of-service via warnings rather than code execution.

How to fix it

Upgrade the Linux kernel to commit aba298b35619213ca787d08d472049627d8cd012 or later stable releases containing the fix that incorporates rt6_nh_nlmsg_size() for all siblings.

How to confirm the fix worked

Confirm the patch is applied by checking for the updated rt6_nlmsg_size() logic using rt6_nh_nlmsg_size(); re-run the provided reproduction script and verify absence of the WARNING in dmesg or kernel logs.

Typical attack path

  1. Add IPv6 address and initial route via a physical interface
  2. Create multiple ipvlan sibling interfaces and assign IPv6 addresses
  3. Append routes with lwtunnel encap on the first set of siblings
  4. Append final route without lwtunnel on the last sibling to trigger length miscalculation
  5. Observe WARNING in inet6_rt_notify during netlink route notification

How to detect it

Search kernel logs and dmesg for the exact WARNING string from inet6_rt_notify and call traces involving fib6_add_rt2node or ip6_route_add; correlate with netlink route addition events from processes using ip or similar tools.

What your security team should do

  • Prioritize kernel upgrade to the fixed commit on all systems handling IPv6 routing
  • Audit IPv6 route configurations using lwtunnels or ipvlan for exposure
  • Monitor kernel logs for inet6_rt_notify warnings as a temporary detection measure
  • Apply updates before the CISA-style deadlines if the issue appears in future KEV listings

The record

In the Linux kernel, the following vulnerability has been resolved: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation In function rt6_nlmsg_size(), the length of nexthop is calculated by multipling the nexthop length of fib6_info and the number of siblings. However if the fib6_info has no lwtunnel but the siblings have lwtunnels, the nexthop length is less than it should be, and it will trigger a warning in inet6_rt_notify() as follows: WARNING: CPU: 0 PID: 6082 at net/ipv6/route.c:6180 inet6_rt_notify+0x120/0x130 ...... Call Trace: <TASK> fib6_add_rt2node+0x685/0xa30 fib6_add+0x96/0x1b0 ip6_route_add+0x50/0xd0 inet6_rtm_newroute+0x97/0xa0 rtnetlink_rcv_msg+0x156/0x3d0 netlink_rcv_skb+0x5a/0x110 netlink_unicast+0x246/0x350 netlink_sendmsg+0x250/0x4c0 sock_sendmsg+0x66/0x70 ___sys_sendmsg+0x7c/0xd0 __sys_sendmsg+0x5d/0xb0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc This bug can be reproduced by script: ip -6 addr add 2002::2/64 dev ens2 ip -6 route add 100::/64 via 2002::1 dev ens2 metric 100 for i in 10 20 30 40 50 60 70; do ip link add link ens2 name ipv_$i type ipvlan ip -6 addr add 2002::$i/64 dev ipv_$i ifconfig ipv_$i up done for i in 10 20 30 40 50 60; do ip -6 route append 100::/64 encap ip6 dst 2002::$i via 2002::1 dev ipv_$i metric 100 done ip -6 route append 100::/64 via 2002::1 dev ipv_70 metric 100 This patch fixes it by adding nexthop_len of every siblings using rt6_nh_nlmsg_size().

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 4.11.0 5.4.235

Related vulnerabilities