CVE-2023-6121

Se encontró una vulnerabilidad de lectura fuera de los límites en el subsistema NVMe-oF/TCP del kernel de Linux. Esta falla permite que un atacante remoto envíe un paquete TCP manipulado, lo que desencadena un desbordamiento del búfer que da como resultado que los datos kmalloc se impriman (y potencialmente se filtren) en el búfer de anillo del kernel (dmesg).

Wenqing Liu discovered that the f2fs file system implementation in the Linux kernel did not properly validate inode types while performing garbage collection. An attacker could use this to construct a malicious f2fs image that, when mounted and operated on, could cause a denial of service. It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the Linux kernel did not properly handle certain error conditions during device registration. A local attacker could possibly use this to cause a denial of service.