Loading vulnerability…
Linux kernel TIPC UDP bearer remote denial of service
CVE-2023-1390 is a remotely exploitable denial-of-service vulnerability in the Linux kernel Transparent Inter-Process Communication (TIPC) module. In tipc_link_xmit(), a while loop can enter an invalid state when parsing socket buffers that are not queued. An attacker can trigger this condition by transmitting two small UDP packets to a host configured with a UDP TIPC bearer, causing the affected CPU to become fully utilized.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation exhausts CPU resources, driving utilization to 100% and potentially leaving the system unresponsive. The documented impact is limited to availability; no confidentiality or integrity impact is stated.
If you can’t patch tonight, do this now.
Where immediate patching is not possible, disable the TIPC module or remove/disable UDP TIPC bearer configuration if TIPC-over-UDP is not required. Restrict network access to TIPC UDP bearer traffic with network segmentation and filtering so untrusted systems cannot send packets to the affected service.
Patch, then assume compromise.
Update to a Linux kernel release containing the upstream fix, available in Linux kernel 5.11 and later, or to the vendor-supported kernel package that backports the fix. For affected Red Hat Enterprise Linux 8 deployments, install the applicable fixed kernel, kernel-rt, or kpatch update for the subscribed channel. Reboot after conventional kernel-package updates; live-patch deployments should confirm that the updated live patch is loaded.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.