{
  "cveId": "CVE-2023-52906",
  "url": "https://patchblox.com/security/cve/CVE-2023-52906",
  "summary": "CVE-2023-52906 is fixed in linux on 1 platform, first by DEBIAN-CVE-2023-52906, released August 21, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  net/sched: act_mpls: Fix warning during failed a...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  net/sched: act_mpls: Fix warning during failed attribute validation  The \u0027TCA_MPLS_LABEL\u0027 attribute is of \u0027NLA_U32\u0027 type, but has a validation type of \u0027NLA_VALIDATE_FUNCTION\u0027. This is an invalid combination according to the comment above \u0027struct nla_policy\u0027:  \u0022 Meaning of \u0060validate\u0027 field, use via NLA_POLICY_VALIDATE_FN:    NLA_BINARY           Validation function called for the attribute.    All other            Unused - but note that it\u0027s a union \u0022  This can trigger the warning [1] in nla_get_range_unsigned() when validation of the attribute fails. Despite being of \u0027NLA_U32\u0027 type, the associated \u0027min\u0027/\u0027max\u0027 fields in the policy are negative as they are aliased by the \u0027validate\u0027 field.  Fix by changing the attribute type to \u0027NLA_BINARY\u0027 which is consistent with the above comment and all other users of NLA_POLICY_VALIDATE_FN(). As a result, move the length validation to the validation function.  No regressions in MPLS tests:   # ./tdc.py -f tc-tests/actions/mpls.json  [...]  # echo $?  0  [1] WARNING: CPU: 0 PID: 17743 at lib/nlattr.c:118 nla_get_range_unsigned\u002B0x1d8/0x1e0 lib/nlattr.c:117 Modules linked in: CPU: 0 PID: 17743 Comm: syz-executor.0 Not tainted 6.1.0-rc8 #3 Hardware name: QEMU Standard PC (i440FX \u002B PIIX, 1996), BIOS rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014 RIP: 0010:nla_get_range_unsigned\u002B0x1d8/0x1e0 lib/nlattr.c:117 [...] Call Trace:  \u003CTASK\u003E  __netlink_policy_dump_write_attr\u002B0x23d/0x990 net/netlink/policy.c:310  netlink_policy_dump_write_attr\u002B0x22/0x30 net/netlink/policy.c:411  netlink_ack_tlv_fill net/netlink/af_netlink.c:2454 [inline]  netlink_ack\u002B0x546/0x760 net/netlink/af_netlink.c:2506  netlink_rcv_skb\u002B0x1b7/0x240 net/netlink/af_netlink.c:2546  rtnetlink_rcv\u002B0x18/0x20 net/core/rtnetlink.c:6109  netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]  netlink_unicast\u002B0x5e9/0x6b0 net/netlink/af_netlink.c:1345  netlink_sendmsg\u002B0x739/0x860 net/netlink/af_netlink.c:1921  sock_sendmsg_nosec net/socket.c:714 [inline]  sock_sendmsg net/socket.c:734 [inline]  ____sys_sendmsg\u002B0x38f/0x500 net/socket.c:2482  ___sys_sendmsg net/socket.c:2536 [inline]  __sys_sendmsg\u002B0x197/0x230 net/socket.c:2565  __do_sys_sendmsg net/socket.c:2574 [inline]  __se_sys_sendmsg net/socket.c:2572 [inline]  __x64_sys_sendmsg\u002B0x42/0x50 net/socket.c:2572  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64\u002B0x2b/0x70 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe\u002B0x63/0xcd",
  "published": "2024-08-21T07:15:06Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00248,
  "epssPercentile": 0.1622,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.7-1",
      "fix": "DEBIAN-CVE-2023-52906",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52906",
      "released": "2024-08-21T07:15:06Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.1.7-1",
      "fix": "DEBIAN-CVE-2023-52906",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52906",
      "released": "2024-08-21T07:15:06Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.1.7-1",
      "fix": "DEBIAN-CVE-2023-52906",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52906",
      "released": "2024-08-21T07:15:06Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}