CVE-2023-5685

What it actually does

A large chain of XNIO NotifierState objects triggers uncontrolled recursion that overflows the call stack, resulting in an unhandled exception and termination of the affected process.

Why it matters to the business

Remote unauthenticated attackers can repeatedly crash services that rely on the vulnerable XNIO component, causing denial of service and operational downtime; the issue affects widely used packages in AlmaLinux 8 environments.

How an attack unfolds

An attacker sends a sequence of network requests that force the creation of an excessively deep NotifierState chain inside XNIO; once the chain exceeds the available stack depth the JVM throws a StackOverflowError and the process exits, denying service to legitimate users.

How to fix it

Upgrade kernel-tools-libs-devel on AlmaLinux 8 to version 4.18.0-348.23.1.el8_5 or later; apply the same update across all affected systems and verify the new package is loaded after restart.

How to confirm the fix worked

Confirm the installed package version matches or exceeds the fixed release, then exercise the service under load that previously triggered notifier growth to verify the stack overflow no longer occurs.

Typical attack path

1. Identify a network-reachable service that uses the vulnerable XNIO library
2. Craft and send a series of requests designed to grow the NotifierState chain
3. Trigger the stack overflow, causing the process to terminate
4. Repeat the sequence to maintain denial of service

How to detect it

Review application and system logs for repeated StackOverflowError exceptions originating from XNIO NotifierState classes; correlate with sudden service restarts or high volumes of inbound requests that coincide with process crashes.

What your security team should do

• Immediately schedule the kernel-tools-libs-devel update to 4.18.0-348.23.1.el8_5
• Prioritize internet-facing services that depend on XNIO
• Monitor vendor advisories for any additional dependent packages that require patching