{"id":"CVE-2023-3812","title":"Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags","summary":"An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"Red Hat","product":"kernel-rt","affected":["kernel-rt (all versions)","kernel (all versions)","kpatch-patch","kpatch-patch","kernel (all versions)","kernel (all versions)","kernel-rt (all versions)","kernel (all versions)","kpatch-patch","kernel (all versions)","kernel (all versions)","kernel-rt (all versions)","kernel (all versions)","kernel (all versions)","kpatch-patch","kpatch-patch","kernel (all versions)","kpatch-patch","kernel (all versions)","kernel (all versions)","kpatch-patch","kernel (all versions)","kernel (all versions)","kernel-rt (all versions)","kpatch-patch","kernel (all versions)","kernel-rt (all versions)","kpatch-patch","kernel (all versions)","kernel","kernel","kernel-rt","kernel-rt (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2025-03-05T18:36:18.926997Z"},"published":"2023-07-24","updated":"2026-11-07","sourceUpdated":"2026-11-07T13:41:44.906Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-3812","references":[{"url":"https://access.redhat.com/errata/RHSA-2023:6799","label":"RHSA-2023:6799"},{"url":"https://access.redhat.com/errata/RHSA-2023:6813","label":"RHSA-2023:6813"},{"url":"https://access.redhat.com/errata/RHSA-2023:7370","label":"RHSA-2023:7370"},{"url":"https://access.redhat.com/errata/RHSA-2023:7379","label":"RHSA-2023:7379"},{"url":"https://access.redhat.com/errata/RHSA-2023:7382","label":"RHSA-2023:7382"},{"url":"https://access.redhat.com/errata/RHSA-2023:7389","label":"RHSA-2023:7389"},{"url":"https://access.redhat.com/errata/RHSA-2023:7411","label":"RHSA-2023:7411"},{"url":"https://access.redhat.com/errata/RHSA-2023:7418","label":"RHSA-2023:7418"},{"url":"https://access.redhat.com/errata/RHSA-2023:7548","label":"RHSA-2023:7548"},{"url":"https://access.redhat.com/errata/RHSA-2023:7549","label":"RHSA-2023:7549"},{"url":"https://access.redhat.com/errata/RHSA-2023:7554","label":"RHSA-2023:7554"},{"url":"https://access.redhat.com/errata/RHSA-2024:0340","label":"RHSA-2024:0340"},{"url":"https://access.redhat.com/errata/RHSA-2024:0378","label":"RHSA-2024:0378"},{"url":"https://access.redhat.com/errata/RHSA-2024:0412","label":"RHSA-2024:0412"},{"url":"https://access.redhat.com/errata/RHSA-2024:0461","label":"RHSA-2024:0461"},{"url":"https://access.redhat.com/errata/RHSA-2024:0554","label":"RHSA-2024:0554"},{"url":"https://access.redhat.com/errata/RHSA-2024:0562","label":"RHSA-2024:0562"},{"url":"https://access.redhat.com/errata/RHSA-2024:0563","label":"RHSA-2024:0563"},{"url":"https://access.redhat.com/errata/RHSA-2024:0575","label":"RHSA-2024:0575"},{"url":"https://access.redhat.com/errata/RHSA-2024:0593","label":"RHSA-2024:0593"},{"url":"https://access.redhat.com/errata/RHSA-2024:1961","label":"RHSA-2024:1961"},{"url":"https://access.redhat.com/errata/RHSA-2024:2006","label":"RHSA-2024:2006"},{"url":"https://access.redhat.com/errata/RHSA-2024:2008","label":"RHSA-2024:2008"},{"url":"https://access.redhat.com/security/cve/CVE-2023-3812"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224048","label":"RHBZ#2224048"},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=363a5328f4b0"}],"tags":["cve.org"],"epss":0.00344,"epssPercentile":0.28109,"ingestedAt":"2026-11-07T14:18:21.470Z","slug":"CVE-2023-3812","body":"## Overview\n\nAn out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.\n\n## Affected\n\n- `kernel-rt (all versions)`\n- `kernel (all versions)`\n- `kpatch-patch`\n- `kpatch-patch`\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kernel-rt (all versions)`\n- `kernel (all versions)`\n- `kpatch-patch`\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kernel-rt (all versions)`\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kpatch-patch`\n- `kpatch-patch`\n- `kernel (all versions)`\n- `kpatch-patch`\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kpatch-patch`\n- `kernel (all versions)`\n- `kernel (all versions)`\n- `kernel-rt (all versions)`\n- `kpatch-patch`\n- `kernel (all versions)`\n- `kernel-rt (all versions)`\n- `kpatch-patch`\n- `kernel (all versions)`\n- `kernel`\n- `kernel`\n- `kernel-rt`\n- `kernel-rt (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this issue, prevent the tun module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}