CVE-2023-6200

What it actually does

Race condition in Linux kernel ICMPv6 router advertisement handling allows unauthenticated adjacent-network attacker to trigger arbitrary code execution under specific timing conditions.

Why it matters to the business

Attackers on the local network could gain full control of affected Linux systems, leading to data theft, service disruption, or use as a foothold for further attacks; widespread kernel deployments increase exposure across servers and devices.

How an attack unfolds

An attacker positioned on the same network segment crafts and sends a malicious ICMPv6 router advertisement packet that exploits a race condition in the kernel's packet processing path, resulting in arbitrary code execution without authentication.

How to fix it

Apply kernel update containing commit dade3f6a1e4e or later equivalent patch; rebuild and deploy updated kernel images across all affected systems; test for compatibility before wide rollout.

How to confirm the fix worked

Verify kernel source contains commit dade3f6a1e4e or later; confirm running kernel version matches patched release; monitor for absence of related race-condition symptoms in logs.

Typical attack path

1. Gain access to adjacent network segment
2. Craft malicious ICMPv6 router advertisement packet targeting race condition
3. Transmit packet to trigger kernel flaw
4. Achieve arbitrary code execution on target system

How to detect it

Inspect kernel logs and network captures for anomalous ICMPv6 router advertisement packets coinciding with unexpected process execution or crashes; correlate with adjacent-network traffic sources.

What your security team should do

• Prioritize patching Linux kernel to include commit dade3f6a1e4e on all exposed systems
• Restrict ICMPv6 router advertisement traffic at network boundaries where feasible
• Monitor EPSS and exploit maturity for any increase in risk
• Review adjacent-network access controls to reduce attack surface