Katran could disclose non-initialized kernel memory as part of an IP header.

published 2023-11-28 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-53085

cvss: 7.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits: 0; none known

Katran could disclose non-initialized kernel memory as part of an IP header. The issue was present for IPv4 encapsulation and ICMP (v4) Too Big packet generation. After a bpf_xdp_adjust_head call, Katran code didn’t initialize the Identification field for the IPv4 header, resulting in writing content of kernel memory in that field of IP header. The issue affected all Katran versions prior to commit 6a03106ac1eab39d0303662963589ecb2374c97f

Patch / fix

fixed in 1 links 1

facebook katran 2023-11-15

github.com/facebookincubator/katran@6a03106 commit

Exploit prediction

0.62% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Facebook Katran

Classification

Weakness

CWE-665 Improper Initialization

References

github.com /facebookincubator/katran/commit/6a03106ac1eab39d0303662963589ecb2374c97f
patch
facebook.com /security/advisories/cve-2023-49062
vendor-advisory

Sources

CVE List CVE-2023-49062
NVD CVE-2023-49062

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary