CVE-2023-46838
Linux: netback processing of zero-length transmit fragment
Reported by xen · Published January 29, 2024
Transmit requests in Xen's virtual network protocol can consist of multiple parts. While not really useful, except for the initial part any of them may be of zero length, i.e. carry no data at all. Besides a certain initial portion of the to be transferred data, these parts are directly translated into what Linux calls SKB fragments. Such converted request parts can, when for a particular SKB they are all of length zero, lead to a de-reference of NULL in core networking code.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| kernel-libbpf-devel | Amazon Linux | 6.1.75-99.163.amzn2023 |
| kernel-livepatch-4.14.343-259.562 | Amazon Linux | 1.0-0.amzn2 |
| kernel-libbpf-static | Amazon Linux | 6.1.75-99.163.amzn2023 |
| kernel-headers | Amazon Linux | 6.1.75-99.163.amzn2023, 4.14.343-259.562.amzn2 |
| bpftool | Amazon Linux | 6.1.75-99.163.amzn2023 |
| kernel-tools-devel | Amazon Linux | 6.1.75-99.163.amzn2023 |
| python-perf | Amazon Linux | 4.14.343-259.562.amzn2 |
| kernel-modules-extra-common | Amazon Linux | 6.1.75-99.163.amzn2023 |
| linux_kernel | linux | 6.7.2, 6.6.14, 6.1.75, 5.15.148, 5.10.209, 5.4.268, 4.19.306 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | consult Xen advisory XSA-448 |
| amazon:2023 | kernel-libbpf-devel | 0 |
| amazon:2 | kernel-livepatch-4.14.343-259.562 | 0 |
| amazon:2023 | kernel-libbpf-static | 0 |
| amazon:2 | kernel-headers | 0 |
| amazon:2023 | bpftool | 0 |
| amazon:2023 | kernel-tools-devel | 0 |
| amazon:2 | python-perf | 0 |
| amazon:2023 | kernel-modules-extra-common | 0 |
| amazon:2023 | kernel-headers | 0 |
| Linux | Linux | * |
| amazon:2023 | kernel-tools | 0 |
| amazon:2023 | kernel-modules-extra | 0 |
| amazon:2 | kernel-tools | 0 |
| amazon:2023 | python3-perf | 0 |
| amazon:2023 | kernel | 0 |
| amazon:2023 | kernel-livepatch-6.1.75-99.163 | 0 |
| amazon:2 | perf | 0 |
| alpine | linux-lts | 0, 0 |
| amazon:2023 | kernel-libbpf | 0 |
…and 5 more
Timeline
- Jan 22, 2024 CVE Published
- Jan 31, 2024 EPSS Score (30 in total, the first dated here)
- Mar 30, 2026 Distribution Patch (36 in total, the first dated here)
- Mar 30, 2026 Security Advisory (38 in total, the first dated here)
- Jul 31, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2023-46838
vulnetix vdb fixes CVE-2023-46838Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2023-46838/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart