CVE-2023-1078
Ubuntu Security Notice USN-6133-1
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an out of bounds access, and a lock corruption.
It was discovered that the Traffic-Control Index implementation in the Linux kernel did not properly perform filter deactivation in some situations. A local attacker could possibly use this to gain elevated privileges. Please note that with the fix for this CVE, kernel support for the TCINDEX classifier has been removed. It was discovered that some AMD x86-64 processors with SMT enabled could speculatively execute instructions using a return address from a sibling thread. A local attacker could possibly use this to expose sensitive information.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2023-02-27 CVE Reserved
- 2023-03-27 CVE Published
- 2025-05-05 CVE Updated
- 2025-06-19 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-787: Out-of-bounds Write
- CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2023/11/05/1 | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html | Mailing List |
|
| https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html | Mailing List |
|
| https://security.netapp.com/advisory/ntap-20230505-0004 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=f753a68980cf4b59a80fe677619da2b1804f526d | 2023-11-05 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.17 < 4.19.273 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.17 < 4.19.273" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 4.20 < 5.4.232 Search vendor "Linux" for product "Linux Kernel" and version " >= 4.20 < 5.4.232" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.5 < 5.10.168 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.5 < 5.10.168" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.11 < 5.15.94 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.11 < 5.15.94" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 5.16 < 6.1.12 Search vendor "Linux" for product "Linux Kernel" and version " >= 5.16 < 6.1.12" | - |
Affected
| ||||||