CVE-2023-44466

HIGH 8.8CVE-2023-44466 · Published 29/09/2023 · updated 17/06/2026

In short

CVE-2023-44466 is a HIGH (CVSS 8.8) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 45.6%, higher than 98.8% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5. There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This occurs because of an untrusted length taken from a TCP packet in ceph_decode_32.

References

git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit · Mailing List
google/security-research security advisory · Exploit
torvalds/linux commit a282a2f · Patch
security.netapp.com/advisory/ntap-20231116-0003 · Third Party Advisory
spinics.net/lists/ceph-devel/msg57909.html · Mailing List

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free