CVE-2023-52340: Linux Kernel IPv6 DoS Vulnerability

CVE-2023-52340 Overview

CVE-2023-52340 is a denial-of-service vulnerability in the IPv6 implementation of the Linux kernel before version 6.3. The flaw resides in net/ipv6/route.c, where the max_size threshold for the IPv6 route cache can be exhausted by an attacker. Sending IPv6 packets in a loop through a raw socket consumes the cache and triggers network is unreachable errors. The issue is tracked as [CWE-400] Uncontrolled Resource Consumption and affects networking availability on impacted hosts.

Critical Impact
Remote attackers can render the IPv6 stack unusable on affected Linux systems by exhausting the route cache through crafted raw-socket traffic.

Affected Products

Linux Kernel versions prior to 6.3
Debian LTS distributions (addressed in June 2024 advisories)
NetApp products incorporating affected Linux kernel versions

Discovery Timeline

2024-07-05 - CVE-2023-52340 published to NVD
2024-06 - Debian LTS security announcements released
2024-08-16 - NetApp Security Advisory ntap-20240816-0005 issued
2025-11-04 - Last updated in NVD database

Technical Details for CVE-2023-52340

Vulnerability Analysis

The Linux kernel maintains an IPv6 routing cache governed by a max_size threshold defined in net/ipv6/route.c. The cache stores route entries created in response to traffic processed by the kernel network stack. When the number of cached entries exceeds the threshold, the kernel returns ENETUNREACH to applications attempting further IPv6 transmissions.

The vulnerability allows a local attacker holding a raw socket to flood the kernel with IPv6 packets that each create new route cache entries. Because cache eviction does not keep pace with insertion under sustained traffic, the cache saturates quickly. Once saturated, the kernel rejects subsequent IPv6 packet handling, breaking outbound network connectivity for all IPv6-dependent services on the host.

The upstream fix landed in Linux 6.3 via commit af6d10345ca76670c1b7c37799f0d5576ccef277, which adjusts the route cache accounting behavior to prevent trivial saturation.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400] in the IPv6 route cache management logic. The max_size threshold protects memory but does not adequately throttle attacker-controlled growth, allowing the cache to fill faster than entries are reclaimed.

Attack Vector

An attacker with permission to open a raw socket sends IPv6 packets in a tight loop. Each packet causes the kernel to allocate or look up a route entry, growing the cache. Once the threshold is crossed, the kernel emits network is unreachable errors and IPv6 traffic ceases until cached entries expire. The attack requires no authentication beyond raw socket capability and no user interaction.

Technical details and the patch are available in the Linux Kernel Commit af6d103 and the Linux Kernel 6.3 ChangeLog.

Detection Methods for CVE-2023-52340

Indicators of Compromise

Sudden spike in IPv6 route cache entries reported by ip -6 route show cache or /proc/net/rt6_stats
Repeated network is unreachable errors in system logs for IPv6 destinations
Sustained high-volume IPv6 raw-socket traffic originating from a single process or remote source

Detection Strategies

Monitor kernel counters for IPv6 route cache size and compare against historical baselines
Alert on processes that open raw IPv6 sockets and generate sustained packet bursts
Correlate kernel ENETUNREACH log entries with network telemetry for IPv6 flooding patterns

Monitoring Recommendations

Collect kernel network statistics through node exporters or telemetry agents for centralized analysis
Track auditd events for socket(AF_INET6, SOCK_RAW, ...) calls in production environments
Establish alerting thresholds for abnormal growth in the IPv6 routing cache

How to Mitigate CVE-2023-52340

Immediate Actions Required

Upgrade affected systems to Linux kernel 6.3 or later, or apply the distribution-specific backport
Apply vendor patches from Debian LTS and NetApp where applicable
Restrict the CAP_NET_RAW capability to trusted processes and users only

Patch Information

The fix is included in Linux kernel 6.3 via commit af6d10345ca76670c1b7c37799f0d5576ccef277. Debian LTS published patched packages in June 2024, referenced in the Debian LTS Announcement June 2024 and the follow-up advisory. NetApp customers should consult the NetApp Security Advisory ntap-20240816-0005 for product-specific guidance.

Workarounds

Tune net.ipv6.route.max_size and garbage collection sysctls to slow cache saturation as a temporary measure
Disable IPv6 on systems that do not require it until patches can be deployed
Apply network filtering to drop unsolicited IPv6 traffic from untrusted sources at perimeter devices

bash

# Configuration example - increase route cache size and tighten GC behavior
sysctl -w net.ipv6.route.max_size=16384
sysctl -w net.ipv6.route.gc_interval=10
sysctl -w net.ipv6.route.gc_timeout=30

# Verify current IPv6 route cache state
ip -6 route show cache | wc -l
cat /proc/net/rt6_stats