CVE-2023-1390: Linux Kernel TIPC Module DoS Vulnerability

CVE-2023-1390 Overview

CVE-2023-1390 is a remote denial of service vulnerability in the Linux kernel's Transparent Inter-Process Communication (TIPC) kernel module. The flaw resides in the tipc_link_xmit() function, where a while loop enters an unknown state while attempting to parse socket buffers (SKBs) that are not present in the queue. An unauthenticated attacker can send two small User Datagram Protocol (UDP) packets to a system configured with a UDP bearer, causing CPU utilization to spike to 100% and triggering a denial of service. The vulnerability affects multiple Linux kernel versions, including 5.11 release candidates.

Critical Impact
Two small UDP packets sent to a Linux system with a TIPC UDP bearer enabled drive CPU usage to 100%, rendering the host unresponsive.

Affected Products

Linux Kernel (multiple versions prior to the upstream fix)
Linux Kernel 5.11-rc1, 5.11-rc2, 5.11-rc3
Distributions shipping the vulnerable TIPC module with UDP bearer support

Discovery Timeline

2023-03-16 - CVE-2023-1390 published to the National Vulnerability Database (NVD)
2025-04-23 - Last updated in NVD database

Technical Details for CVE-2023-1390

Vulnerability Analysis

The TIPC protocol provides cluster-internal messaging between Linux nodes and supports multiple bearer types, including UDP encapsulation. The defect lives in tipc_link_xmit(), the link layer transmit routine responsible for queuing and forwarding SKBs across a TIPC link.

When specially crafted UDP packets reach a host with an active TIPC UDP bearer, the transmit path enters a while loop that iterates over SKBs assumed to be present in the send queue. Because the loop does not correctly validate queue state, it reaches a condition where the expected SKBs are absent, yet the loop continues to execute. The kernel thread spins indefinitely, consuming an entire CPU core and starving other work on the system.

The issue is categorized under [CWE-1050] (Excessive Platform Resource Consumption within a Loop). No authentication, user interaction, or local access is required to trigger the condition.

Root Cause

The root cause is missing loop-termination validation in tipc_link_xmit(). The function assumes SKBs queued for transmission remain valid throughout iteration, but specific packet sequences cause the queue state to diverge from what the loop expects. Without a bounded exit condition for this scenario, the kernel enters an infinite loop.

Attack Vector

Exploitation requires network reachability to a Linux host that has the TIPC kernel module loaded and a UDP bearer configured. The attacker sends two small UDP datagrams to the TIPC UDP bearer port. Receipt of these packets is sufficient to drive tipc_link_xmit() into the faulty loop, producing sustained 100% CPU utilization. No credentials, prior foothold, or user action are needed.

A proof of concept demonstrating the trigger is publicly available; see the GitHub Gist PoC and the InfoSec Exchange Post for background. The upstream fix is documented in the Linux kernel commit b7741344.

Detection Methods for CVE-2023-1390

Indicators of Compromise

Sustained 100% CPU utilization on a single core attributable to a kernel thread handling TIPC traffic.
Unsolicited UDP packets arriving at the configured TIPC UDP bearer port from untrusted sources.
System-wide unresponsiveness or scheduler latency on hosts where the tipc module is loaded.

Detection Strategies

Audit running hosts for the presence of the tipc kernel module using lsmod | grep tipc and identify systems that do not require it.
Inspect TIPC bearer configuration with tipc bearer list to confirm whether a UDP bearer is active and exposed.
Correlate sudden CPU saturation events on Linux hosts with inbound UDP flows toward the TIPC bearer port at the network layer.

Monitoring Recommendations

Alert on Linux hosts reporting prolonged single-core CPU saturation in kernel mode without a corresponding user-space workload.
Monitor network telemetry for low-volume UDP traffic patterns targeting hosts that expose TIPC bearers outside cluster boundaries.
Track kernel version inventory and flag hosts running kernels predating the upstream patch commit b77413446408fdd256599daf00d5be72b5f3e7c6.

How to Mitigate CVE-2023-1390

Immediate Actions Required

Apply the Linux kernel update from your distribution that includes upstream commit b77413446408fdd256599daf00d5be72b5f3e7c6.
Unload the tipc kernel module on systems that do not require cluster messaging using modprobe -r tipc.
Restrict inbound UDP traffic to the TIPC bearer port at host and network firewalls so only trusted cluster peers can reach it.

Patch Information

The upstream fix corrects the loop logic in tipc_link_xmit() so that the function terminates safely when expected SKBs are not present in the queue. Patched kernels are available from the mainline Linux tree and downstream distribution vendors. Refer to the GitHub Linux Commit and the NetApp Security Advisory for affected product mappings.

Workarounds

Blacklist the tipc module on hosts that do not use TIPC, preventing it from loading after reboot.
Remove or disable any configured TIPC UDP bearer where cluster messaging is not required.
Filter UDP traffic destined for the TIPC bearer port at the perimeter and segment cluster traffic onto isolated networks.

bash

# Configuration example
# Disable and blacklist the TIPC kernel module
sudo modprobe -r tipc
echo "blacklist tipc" | sudo tee /etc/modprobe.d/blacklist-tipc.conf

# Verify the module is no longer loaded
lsmod | grep tipc

# If TIPC is required, list and remove any UDP bearers
sudo tipc bearer list
sudo tipc bearer disable media udp name <bearer_name>