CVE-2023-52881

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: do not accept ACK of bytes we never sent

This patch is based on a detailed report and ideas from Yepeng Pan

and Christian Rossow.

ACK seq validation is currently following RFC 5961 5.2 guidelines:

The ACK value is considered acceptable only if

it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <=

SND.NXT). All incoming segments whose ACK value doesn't satisfy the

above condition MUST be discarded and an ACK sent back. It needs to

be noted that RFC 793 on page 72 (fifth check) says: "If the ACK is a

duplicate (SEG.ACK < SND.UNA), it can be ignored. If the ACK

acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an

ACK, drop the segment, and return". The "ignored" above implies that

the processing of the incoming data segment continues, which means

the ACK value is treated as acceptable. This mitigation makes the

ACK check more stringent since any ACK < S

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References