CVE-2023-2006 : A race condition was found in the Linux kernel's RxRPC network protocol, within

A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles. This issue results from the lack of proper locking when performing operations on an object. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.

Published 2023-04-24 21:15:09

Updated 2025-04-23 17:16:29

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2023-2006

Linux » Linux Kernel
Versions from including (>=) 5.11 and before (<) 5.15.81
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.10 and before (<) 5.10.157
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.16 and before (<) 6.0.11
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Netapp » Hci Baseboard Management Controller » Version: H300s
cpe:2.3:a:netapp:hci_baseboard_management_controller:h300s:*:*:*:*:*:*:*
Matching versions
Netapp » Hci Baseboard Management Controller » Version: H410s
cpe:2.3:a:netapp:hci_baseboard_management_controller:h410s:*:*:*:*:*:*:*
Matching versions
Netapp » Hci Baseboard Management Controller » Version: H500s
cpe:2.3:a:netapp:hci_baseboard_management_controller:h500s:*:*:*:*:*:*:*
Matching versions
Netapp » Hci Baseboard Management Controller » Version: H700s
cpe:2.3:a:netapp:hci_baseboard_management_controller:h700s:*:*:*:*:*:*:*
Matching versions
Netapp » Hci Baseboard Management Controller » Version: H410c
cpe:2.3:a:netapp:hci_baseboard_management_controller:h410c:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2023-2006

EPSS FAQ

0.02%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 3 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-2006

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.0	HIGH	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	1.0	5.9	134c704f-9b21-4f2e-91b3-4a467353bcc0	2025-04-23
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.0	HIGH	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	1.0	5.9	NIST
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-2006

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)

References for CVE-2023-2006

https://github.com/torvalds/linux/commit/3bcd6c7eaa53

rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CA… · torvalds/linux@3bcd6c7 · GitHub
Patch
https://www.zerodayinitiative.com/advisories/ZDI-23-439/

ZDI-23-439 | Zero Day Initiative
Third Party Advisory;VDB Entry
https://security.netapp.com/advisory/ntap-20230609-0004/

CVE-2023-2006 Linux Kernel Vulnerability in NetApp Products | NetApp Product Security
Patch;Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2189112

2189112 – (CVE-2023-2006) CVE-2023-2006 kernel: rxrpc: race condition between connection bundle lookup and removal
Issue Tracking;Patch;Third Party Advisory

Jump to

Vulnerability Details : CVE-2023-2006

Products affected by CVE-2023-2006

Exploit prediction scoring system (EPSS) score for CVE-2023-2006

CVSS scores for CVE-2023-2006

CWE ids for CVE-2023-2006

References for CVE-2023-2006