CVE-2023-3090 Out-of-bounds write in Linux kernel's ipvlan network driver

High 7.8 Published 28 Jun 2023 Updated 5 Mar 2025

A heap out-of-bounds write in the Linux kernel ipvlan driver allows local attackers to escalate privileges when the feature is enabled.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-3090?

CVE-2023-3090 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 28 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.

The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled.

We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.

Weakness: CWE-787

Which versions are affected by CVE-2023-3090?

It affects 2 products.

Linux distribution packages (18)

`kpatch-patch-5_14_0-70_43_1` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-6.el9_0`
`kpatch-patch-5_14_0-70_43_1-debuginfo` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-6.el9_0`
`kpatch-patch-5_14_0-70_43_1-debugsource` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-6.el9_0`
`kpatch-patch-5_14_0-70_49_1` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-5.el9_0`
`kpatch-patch-5_14_0-70_49_1-debuginfo` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-5.el9_0`
`kpatch-patch-5_14_0-70_49_1-debugsource` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-5.el9_0`
`kpatch-patch-5_14_0-70_50_2` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-4.el9_0`
`kpatch-patch-5_14_0-70_50_2-debuginfo` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-4.el9_0`
`kpatch-patch-5_14_0-70_50_2-debugsource` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-4.el9_0`
`kpatch-patch-5_14_0-70_53_1` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-3.el9_0`
`kpatch-patch-5_14_0-70_53_1-debuginfo` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-3.el9_0`
`kpatch-patch-5_14_0-70_53_1-debugsource` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-3.el9_0`
`kpatch-patch-5_14_0-70_58_1` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-2.el9_0`
`kpatch-patch-5_14_0-70_58_1-debuginfo` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-2.el9_0`
`kpatch-patch-5_14_0-70_58_1-debugsource` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-2.el9_0`
`kpatch-patch-5_14_0-70_64_1` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-1.el9_0`
`kpatch-patch-5_14_0-70_64_1-debuginfo` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-1.el9_0`
`kpatch-patch-5_14_0-70_64_1-debugsource` Red Hat:rhel_eus:9.0::baseos	All versions	`0:1-1.el9_0`

Products include Debian Debian Linux, Linux kernel.

How do I fix CVE-2023-3090?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-3090 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3090 exists.

All Debian Debian Linux vulnerabilities

Sources

Also known as AZL-27350, DEBIAN-CVE-2023-3090, GHSA-295v-9m5g-79q9, RHSA-2023:4828, UBUNTU-CVE-2023-3090.