Linux Kernel Netfilter Subsystem nft_payload.c nft_payload_copy_vlan buffer overflow

Summaryinfo

A vulnerability identified as critical has been detected in Linux Kernel. The impacted element is the function nft_payload_copy_vlan of the file nft_payload.c of the component Netfilter Subsystem. This manipulation causes buffer overflow. The identification of this vulnerability is CVE-2023-0179. There is no exploit available. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in Linux Kernel (Operating System) (affected version not known). It has been declared as critical. Affected by this vulnerability is the function nft_payload_copy_vlan of the file nft_payload.c of the component Netfilter Subsystem. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was shared 02/10/2023. It is possible to read the advisory at openwall.com. This vulnerability is known as CVE-2023-0179 since 01/11/2023. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 12/07/2025).

The vulnerability scanner Nessus provides a plugin with the ID 236642 (Alibaba Cloud Linux 3 : 0042: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2023:0042)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at patchwork.ozlabs.org.

The vulnerability is also documented in the databases at Tenable (236642), EUVD (EUVD-2023-12268) and CERT Bund (WID-SEC-2025-0649). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• Dell Avamar
• Open Source Linux Kernel
• SolarWinds Security Event Manager
• Dell NetWorker
• Dell Secure Connect Gateway

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion