LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54114: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()

In the Linux kernel, the following vulnerability has been resolved: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() As the call trace shows, skb_panic was caused by wrong skb->mac_header in nsh_gso_segment(): invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 3 PID: 2737 Comm: syz Not tainted 6.3.0-next-20230505 #1 RIP: 0010:skb_panic+0xda/0xe0 call Trace: skb_push+0x91/0xa0 nsh_gso_segment+0x4f3/0x570 skb_mac_gso_segment+0x19e/0x270 __skb_gso_segment+0x1e8/0x3c0 validate_xmit_skb+0x452/0x890 validate_xmit_skb_list+0x99/0xd0 sch_direct_xmit+0x294/0x7c0 __dev_queue_xmit+0x16f0/0x1d70 packet_xmit+0x185/0x210 packet_snd+0xc15/0x1170 packet_sendmsg+0x7b/0xa0 sock_sendmsg+0x14f/0x160 The root cause is: nsh_gso_segment() use skb->network_header - nhoff to reset mac_header in skb_gso_error_unwind() if inner-layer protocol gso fails. However, skb->network_header may be reset by inner-layer protocol gso function e.g. mpls_gso_segment. skb->mac_header reset by the inaccurate network_header will be larger than skb headroom. nsh_gso_segment nhoff = skb->network_header - skb->mac_header; __skb_pull(skb,nsh_len) skb_mac_gso_segment mpls_gso_segment skb_reset_network_header(skb);//skb->network_header+=nsh_len return -EINVAL; skb_gso_error_unwind skb_push(skb, nsh_len); skb->mac_header = skb->network_header - nhoff; // skb->mac_header > skb->headroom, cause skb_push panic Use correct mac_offset to restore mac_header and get rid of nhoff.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw can trigger a kernel crash when Network Service Header traffic is processed through generic segmentation offload and an inner protocol segmentation error occurs. The business impact is most likely denial of service on affected Linux systems, but the provided sources do not establish active exploitation or remote reachability.

Executive priority

Schedule remediation in the normal high-priority kernel patch cycle. Escalate faster for systems handling untrusted network traffic or service-chain encapsulation. Current sources do not justify emergency response for all Linux assets.

Technical view

In nsh_gso_segment(), error unwind used skb->network_header-derived nhoff to restore skb->mac_header. Inner GSO, such as MPLS, may reset network_header before returning an error, causing mac_header restoration beyond headroom and skb_push panic. The fix uses the correct mac_offset.

Likely exposure

Exposure appears limited to Linux systems running affected kernel branches with NSH/GSO code paths reachable. Systems not using NSH-related networking are less likely exposed, but kernel packaging and enabled features should be verified against vendor advisories.

Exploitation context

The source bundle shows a syzkaller-style kernel panic trace and KEV is false. No cited source states active exploitation, public weaponization, or confirmed remote exploitation. Treat exploitation context as incomplete.

Researcher notes

The vulnerability is a GSO error-unwind state restoration bug in net/nsh. The supplied record lacks CVSS, CWE, exploitability assessment, and distribution-specific package mapping, so validation should focus on source-level fix presence and vendor kernel advisories.

Mitigation direction

  • Update to a kernel or distribution package containing the referenced stable fixes.
  • Prioritize internet-facing, packet-processing, virtualization, and service-chain Linux hosts.
  • Check Linux distribution advisories for backported fixes and exact package versions.
  • If immediate patching is delayed, review whether NSH-related networking is enabled or reachable.

Validation and detection

  • Inventory Linux kernel versions across production and edge systems.
  • Map installed kernels to vendor advisories or the referenced stable commits.
  • Confirm patched systems boot into the fixed kernel, not only install it.
  • Review crash logs for skb_panic traces involving nsh_gso_segment.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54114 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc411ed854584a71b0e86ac3019b60e4789d88086, c411ed854584a71b0e86ac3019b60e4789d88086, c411ed854584a71b0e86ac3019b60e4789d88086, c411ed854584a71b0e86ac3019b60e4789d88086, c411ed854584a71b0e86ac3019b60e4789d88086, c411ed854584a71b0e86ac3019b60e4789d88086, c411ed854584a71b0e86ac3019b60e4789d88086, c411ed854584a71b0e86ac3019b60e4789d88086unaffected
LinuxLinux4.14, 0, 4.14.316, 4.19.284, 5.4.244, 5.10.181, 5.15.113, 6.1.30, 6.3.4, 6.4affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.