Read the docs
TI-2023-28901 Aliases CVE-2023-52558GHSA-4cg8-w873-pfqx

OpenBSD 7.4 and 7.3 m_split() network buffer kernel crash

Priority MEDIUM 40CWE-131Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-131 and the CVSS impact.

Summary

In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after receiving specially crafted escape sequences.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00702 53rd percentileScored 2026-11-07
Fix Fixed OpenBSD (OpenBSD): 7.3 errata 019, 7.4 errata 002

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenBSDOpenBSD7.3 to before 7.3 errata 019; 7.4 to before 7.4 errata 0027.3 errata 019, 7.4 errata 002Patch availableCNA
  • OpenBSD VendorOpenBSD Affected 7.3 to before 7.3 errata 019; 7.4 to before 7.4 errata 002 Fixed in 7.3 errata 019, 7.4 errata 002 Patch available CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*before 7.3VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:-:*:*:*:*:*:*7.3VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_001:*:*:*:*:*:*7.3 errata_001VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_002:*:*:*:*:*:*7.3 errata_002VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_003:*:*:*:*:*:*7.3 errata_003VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_004:*:*:*:*:*:*7.3 errata_004VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_005:*:*:*:*:*:*7.3 errata_005VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_006:*:*:*:*:*:*7.3 errata_006VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_007:*:*:*:*:*:*7.3 errata_007VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_008:*:*:*:*:*:*7.3 errata_008VulnerableOpenBSD
  • cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:* Versions before 7.3 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:-:*:*:*:*:*:* Versions 7.3 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_001:*:*:*:*:*:* Versions 7.3 errata_001 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_002:*:*:*:*:*:* Versions 7.3 errata_002 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_003:*:*:*:*:*:* Versions 7.3 errata_003 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_004:*:*:*:*:*:* Versions 7.3 errata_004 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_005:*:*:*:*:*:* Versions 7.3 errata_005 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_006:*:*:*:*:*:* Versions 7.3 errata_006 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_007:*:*:*:*:*:* Versions 7.3 errata_007 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_008:*:*:*:*:*:* Versions 7.3 errata_008 Vulnerable ·OpenBSD
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:openbsd:openbsd:7.3:errata_009:*:*:*:*:*:*7.3 errata_009VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_010:*:*:*:*:*:*7.3 errata_010VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_011:*:*:*:*:*:*7.3 errata_011VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_012:*:*:*:*:*:*7.3 errata_012VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_013:*:*:*:*:*:*7.3 errata_013VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_014:*:*:*:*:*:*7.3 errata_014VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_015:*:*:*:*:*:*7.3 errata_015VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_016:*:*:*:*:*:*7.3 errata_016VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_017:*:*:*:*:*:*7.3 errata_017VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.3:errata_018:*:*:*:*:*:*7.3 errata_018VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:-:*:*:*:*:*:*7.4VulnerableOpenBSD
cpe:2.3:o:openbsd:openbsd:7.4:errata_001:*:*:*:*:*:*7.4 errata_001VulnerableOpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_009:*:*:*:*:*:* Versions 7.3 errata_009 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_010:*:*:*:*:*:* Versions 7.3 errata_010 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_011:*:*:*:*:*:* Versions 7.3 errata_011 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_012:*:*:*:*:*:* Versions 7.3 errata_012 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_013:*:*:*:*:*:* Versions 7.3 errata_013 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_014:*:*:*:*:*:* Versions 7.3 errata_014 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_015:*:*:*:*:*:* Versions 7.3 errata_015 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_016:*:*:*:*:*:* Versions 7.3 errata_016 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_017:*:*:*:*:*:* Versions 7.3 errata_017 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.3:errata_018:*:*:*:*:*:* Versions 7.3 errata_018 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:-:*:*:*:*:*:* Versions 7.4 Vulnerable ·OpenBSD
  • cpe:2.3:o:openbsd:openbsd:7.4:errata_001:*:*:*:*:*:* Versions 7.4 errata_001 Vulnerable ·OpenBSD

Remediation

  • Fix · CNA OpenBSD (OpenBSD) Fixed in 7.3 errata 019, 7.4 errata 002

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-52558
  2. 2026-10-03 Alias added: GHSA-4cg8-w873-pfqx

References

Patch 3

  • TI-2002-00376 Integer overflow in xdr_array function in RPC servers for operating systems that use… CVSS 3.1CRITICAL 9.8
  • TI-2003-00437 Off-by-one error in the fb_realpath() function, as derived from the realpath function in… CVSS 3.1CRITICAL 9.8
  • TI-2007-05153 Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD… CVSS 2.0HIGH 7.2
  • TI-2001-00539 Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows… CVSS 2.0HIGH 10.0
  • TI-2026-40218 sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication… CVSS 3.1HIGH 8.3
  • TI-2004-00444 Heap-based buffer overflow in proxy_util.c for mod_proxy in Apache 1.3.25 to 1.3.31… CVSS 2.0HIGH 10.0
See all 200 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences