CVE-2023-2006 is a high-severity vulnerability affecting the Linux kernel's RxRPC network protocol, specifically impacting certain versions of the Linux kernel and NetApp's HCI Baseboard Management Controller. This vulnerability arises from the lack of proper locking when performing operations on an object, potentially allowing an attacker to escalate privileges and execute arbitrary code in the context of the kernel. The issue is particularly relevant to systems running specific Linux kernel versions and certain NetApp products.

How do I know if I'm affected?

If you're wondering whether your system is affected by the vulnerability, you should check if you're using any of the following: Linux kernel versions from 5.10 up to (excluding) 5.10.157, Linux kernel versions from 5.11 up to (excluding) 5.15.81, Linux kernel versions from 5.16 up to (excluding) 6.0.11, or specific NetApp products such as NetApp HCI Baseboard Management Controller H300s, H410c, H410s, H500s, or H700s. This vulnerability is a race condition in the Linux kernel's RxRPC network protocol, which could allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to take action to secure your system. First, update your Linux kernel to a version that includes the fix for this vulnerability. For NetApp users, check the NetApp Product Security page for updates and contact NetApp Technical Support if needed. Always monitor official sources for further updates and guidance.

Is CVE-2023-2006 in CISA’s Known Exploited Vulnerabilities Catalog?

Yes, it is in CISA's Known Exploited Vulnerabilities Catalog. This race condition in the Linux kernel's RxRPC network protocol was added on April 24, 2023. Although a specific due date and required action are not provided, it is crucial to update affected systems and monitor official sources for further guidance to mitigate the risk of unauthorized access, data modification, or system unavailability.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-362, which is a race condition in the Linux kernel's RxRPC network protocol that can lead to unauthorized access, data modification, or system unavailability. It affects certain Linux kernel versions and specific NetApp products.

For more details

CVE-2023-2006 is a significant vulnerability affecting the Linux kernel and specific NetApp products, with potential consequences such as unauthorized access, data modification, and system unavailability. To gain a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the detailed report on the NVD page or the links below.

• Red Hat Bugzilla Issue

• NetApp Security Advisory

• Zero Day Initiative Advisory

• Linux Kernel Patch on GitHub