CVE-2023-42755
Kernel: rsvp: out-of-bounds read in rsvp_classify()
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service.
Se encontró una falla en el clasificador del IPv4 Resource Reservation Protocol (RSVP) en el kernel de Linux. El puntero xprt puede ir más allá de la parte lineal del skb, lo que lleva a una lectura fuera de límites en la función `rsvp_classify`. Este problema puede permitir que un usuario local bloquee el sistema y provoque una denegación de servicio.
This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the processing of RSVP filters. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilties to escalate privileges and execute arbitrary code in the context of the kernel.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-09-13 CVE Reserved
- 2023-10-05 CVE Published
- 2024-06-12 EPSS Updated
- 2024-09-13 CVE Updated
- 2024-09-13 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (7)
URL | Tag | Source |
---|---|---|
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html | Mailing List | |
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html |
URL | Date | SRC |
---|---|---|
https://seclists.org/oss-sec/2023/q3/229 | 2024-09-13 |
URL | Date | SRC |
---|---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=2239847 | 2024-05-22 |
URL | Date | SRC |
---|---|---|
https://access.redhat.com/errata/RHSA-2024:2950 | 2024-05-22 | |
https://access.redhat.com/errata/RHSA-2024:3138 | 2024-05-22 | |
https://access.redhat.com/security/cve/CVE-2023-42755 | 2024-05-22 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | < 6.3 Search vendor "Linux" for product "Linux Kernel" and version " < 6.3" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
|