CVE-2023-54114: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-g58j-c94r-957c
Share
Published
Advisory Summary

CVE-2023-54114 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2023-54114 at a Glance

CVE Identifier CVE-2023-54114
GHSA Identifier GHSA-g58j-c94r-957c
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2023-54114

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2023-54114, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() As the call trace shows, skb_panic was caused by wrong skb->mac_header in nsh_gso_segment(): invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 3 PID: 2737 Comm: syz Not tainted 6.3.0-next-20230505 #1 RIP: 0010:skb_panic+0xda/0xe0 call Trace: skb_push+0x91/0xa0 nsh_gso_segment+0x4f3/0x570 skb_mac_gso_segment+0x19e/0x270 __skb_gso_segment+0x1e8/0x3c0 validate_xmit_skb+0x452/0x890 validate_xmit_skb_list+0x99/0xd0 sch_direct_xmit+0x294/0x7c0 __dev_queue_xmit+0x16f0/0x1d70 packet_xmit+0x185/0x210 packet_snd+0xc15/0x1170 packet_sendmsg+0x7b/0xa0 sock_sendmsg+0x14f/0x160 The root cause is: nsh_gso_segment() use skb->network_header - nhoff to reset mac_header in skb_gso_error_unwind() if inner-layer protocol gso fails. However, skb->network_header may be reset by inner-layer protocol gso function e.g. mpls_gso_segment. skb->mac_header reset by the inaccurate network_header will be larger than skb headroom. nsh_gso_segment nhoff = skb->network_header - skb->mac_header; __skb_pull(skb,nsh_len) skb_mac_gso_segment mpls_gso_segment skb_reset_network_header(skb);//skb->network_header+=nsh_len return -EINVAL; skb_gso_error_unwind skb_push(skb, nsh_len); skb->mac_header = skb->network_header - nhoff; // skb->mac_header > skb->headroom, cause skb_push panic Use correct mac_offset to restore mac_header and get rid of nhoff.

References

NVD — CVE-2023-54114 NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-54114
git.kernel.org/stable/c/02b20e0bc0... WEB
https://git.kernel.org/stable/c/02b20e0bc0c2628539e9e518dc342787c3332de2
git.kernel.org/stable/c/2f88c8d38e... WEB
https://git.kernel.org/stable/c/2f88c8d38ecf5ed0273f99a067246899ba499eb2
git.kernel.org/stable/c/435855b083... WEB
https://git.kernel.org/stable/c/435855b0831b351cb72cb38369ee33122ce9574c
git.kernel.org/stable/c/6fbedf987b... WEB
https://git.kernel.org/stable/c/6fbedf987b6b8ed54a50e2205d998eb2c8be72f9
git.kernel.org/stable/c/c83b49383b... WEB
https://git.kernel.org/stable/c/c83b49383b595be50647f0c764a48c78b5f3c4f8
git.kernel.org/stable/c/cb38e62922... WEB
https://git.kernel.org/stable/c/cb38e62922aa3991793344b5a5870e7291c74a44
git.kernel.org/stable/c/cdd8160dcd... WEB
https://git.kernel.org/stable/c/cdd8160dcda1fed2028a5f96575a84afc23aff7d
git.kernel.org/stable/c/d2309e0cb2... WEB
https://git.kernel.org/stable/c/d2309e0cb27b6871b273fbc1725e93be62570d86

Frequently Asked Questions

What is CVE-2023-54114?
CVE-2023-54114 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2023-54114?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2023-54114?
CVE-2023-54114 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2023-54114?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-g58j-c94r-957c",
  "modified" : "2025-12-24T15:30:38Z",
  "published" : "2025-12-24T15:30:38Z",
  "aliases" : [ "CVE-2023-54114" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()\n\nAs the call trace shows, skb_panic was caused by wrong skb->mac_header\nin nsh_gso_segment():\n\ninvalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 3 PID: 2737 Comm: syz Not tainted 6.3.0-next-20230505 #1\nRIP: 0010:skb_panic+0xda/0xe0\ncall Trace:\n skb_push+0x91/0xa0\n nsh_gso_segment+0x4f3/0x570\n skb_mac_gso_segment+0x19e/0x270\n __skb_gso_segment+0x1e8/0x3c0\n validate_xmit_skb+0x452/0x890\n validate_xmit_skb_list+0x99/0xd0\n sch_direct_xmit+0x294/0x7c0\n __dev_queue_xmit+0x16f0/0x1d70\n packet_xmit+0x185/0x210\n packet_snd+0xc15/0x1170\n packet_sendmsg+0x7b/0xa0\n sock_sendmsg+0x14f/0x160\n\nThe root cause is:\nnsh_gso_segment() use skb->network_header - nhoff to reset mac_header\nin skb_gso_error_unwind() if inner-layer protocol gso fails.\nHowever, skb->network_header may be reset by inner-layer protocol\ngso function e.g. mpls_gso_segment. skb->mac_header reset by the\ninaccurate network_header will be larger than skb headroom.\n\nnsh_gso_segment\n    nhoff = skb->network_header - skb->mac_header;\n    __skb_pull(skb,nsh_len)\n    skb_mac_gso_segment\n        mpls_gso_segment\n            skb_reset_network_header(skb);//skb->network_header+=nsh_len\n            return -EINVAL;\n    skb_gso_error_unwind\n        skb_push(skb, nsh_len);\n        skb->mac_header = skb->network_header - nhoff;\n        // skb->mac_header > skb->headroom, cause skb_push panic\n\nUse correct mac_offset to restore mac_header and get rid of nhoff.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-54114"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/02b20e0bc0c2628539e9e518dc342787c3332de2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/2f88c8d38ecf5ed0273f99a067246899ba499eb2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/435855b0831b351cb72cb38369ee33122ce9574c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/6fbedf987b6b8ed54a50e2205d998eb2c8be72f9"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c83b49383b595be50647f0c764a48c78b5f3c4f8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cb38e62922aa3991793344b5a5870e7291c74a44"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/cdd8160dcda1fed2028a5f96575a84afc23aff7d"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d2309e0cb27b6871b273fbc1725e93be62570d86"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2025-12-24T13:16:13Z"
  }
}