Cloudanix VulnDB

CVE-2023-54012

None

CVSS

—

EPSS

0.2%

Published

Dec 24, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A networking configuration change on certain virtual interfaces can unexpectedly crash the entire system when many interfaces are present.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Recursive NETDEV_FEAT_CHANGE notifications during LRO feature synchronization on team/bonding virtual interfaces cause stack overflow instead of iterative propagation to lower devices.

Why it matters to the business

System crashes or kernel instability can occur during routine network interface configuration changes involving large numbers of virtual devices, resulting in unplanned downtime and service disruption.

How an attack unfolds

An attacker with local privileges creates a master team interface and attaches many subordinate team devices, enables LRO on all, then disables LRO on the master; the resulting recursive notification chain exhausts the stack and crashes the kernel.

How to fix it

Upgrade the Linux kernel to a version containing commit 9ea0c5f90a27b5b884d880e146e0f65f3052e401 or later; for Chainguard dcgm-exporter-fips and dcgm-exporter-privileged-fips update to 4.2.3.4.1.3-r1 or newer.

How to confirm the fix worked

Confirm kernel version or package version meets or exceeds the listed fixed releases; test the provided reproducer script to verify the stack overflow no longer occurs.

Typical attack path

  1. Create master team0 interface
  2. Enable LRO on team0
  3. Create 200 subordinate team interfaces under team0
  4. Enable LRO on each subordinate
  5. Disable LRO on team0 to trigger recursive NETDEV_FEAT_CHANGE events

How to detect it

Review kernel logs for stack overflow or oops messages during NETDEV_FEAT_CHANGE events; inspect audit logs for sequences of ip link and ethtool commands creating large numbers of team interfaces followed by an LRO disable operation.

What your security team should do

  • Apply the kernel or package update to all affected systems immediately
  • Limit creation of deeply nested team/bonding interfaces in production environments until patched
  • Monitor for kernel oops or stack overflow events during network feature changes

The record

In the Linux kernel, the following vulnerability has been resolved: net: fix stack overflow when LRO is disabled for virtual interfaces When the virtual interface's feature is updated, it synchronizes the updated feature for its own lower interface. This propagation logic should be worked as the iteration, not recursively. But it works recursively due to the netdev notification unexpectedly. This problem occurs when it disables LRO only for the team and bonding interface type. team0 | +------+------+-----+-----+ | | | | | team1 team2 team3 ... team200 If team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE event to its own lower interfaces(team1 ~ team200). It is worked by netdev_sync_lower_features(). So, the NETDEV_FEAT_CHANGE notification logic of each lower interface work iteratively. But generated NETDEV_FEAT_CHANGE event is also sent to the upper interface too. upper interface(team0) generates the NETDEV_FEAT_CHANGE event for its own lower interfaces again. lower and upper interfaces receive this event and generate this event again and again. So, the stack overflow occurs. But it is not the infinite loop issue. Because the netdev_sync_lower_features() updates features before generating the NETDEV_FEAT_CHANGE event. Already synchronized lower interfaces skip notification logic. So, it is just the problem that iteration logic is changed to the recursive unexpectedly due to the notification mechanism. Reproducer: ip link add team0 type team ethtool -K team0 lro on for i in {1..200} do ip link add team$i master team0 type team ethtool -K team$i lro on done ethtool -K team0 lro off In order to fix it, the notifier_ctx member of bonding/team is introduced.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 4.4.0 5.4.244

Related vulnerabilities