CVE-2023-0458

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-0458
A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or commit 739790605705ddcf18f21782b9c99ad7d53a8c11

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/diff/kernel/sys.c?id=v6.1.8&id2=v6.1.7 Patch
https://github.com/torvalds/linux/commit/739790605705ddcf18f21782b9c99ad7d53a8c11 Patch
https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html Mailing List Third Party Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/diff/kernel/sys.c?id=v6.1.8&id2=v6.1.7 Patch
https://github.com/torvalds/linux/commit/739790605705ddcf18f21782b9c99ad7d53a8c11 Patch
https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

21 Nov 2024, 07:37

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 4.7 		v2 : unknown
v3 : 5.3
References () https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/diff/kernel/sys.c?id=v6.1.8&id2=v6.1.7 - Patch () https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/diff/kernel/sys.c?id=v6.1.8&id2=v6.1.7 - Patch
References () https://github.com/torvalds/linux/commit/739790605705ddcf18f21782b9c99ad7d53a8c11 - Patch () https://github.com/torvalds/linux/commit/739790605705ddcf18f21782b9c99ad7d53a8c11 - Patch
References () https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html - Mailing List, Third Party Advisory

09 May 2023, 13:58

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
CPE cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
CWE CWE-476
References (MISC) https://github.com/torvalds/linux/commit/739790605705ddcf18f21782b9c99ad7d53a8c11 - (MISC) https://github.com/torvalds/linux/commit/739790605705ddcf18f21782b9c99ad7d53a8c11 - Patch
References (MISC) https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/diff/kernel/sys.c?id=v6.1.8&id2=v6.1.7 - (MISC) https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/diff/kernel/sys.c?id=v6.1.8&id2=v6.1.7 - Patch
References (MISC) https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - (MISC) https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html - Mailing List, Third Party Advisory
References (MISC) https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html - (MISC) https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html - Mailing List, Third Party Advisory

03 May 2023, 14:15

Type Values Removed Values Added
References
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html -

03 May 2023, 01:15

Type Values Removed Values Added
References
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html -

26 Apr 2023, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-26 19:15

Updated : 2024-11-21 07:37

NVD link : CVE-2023-0458

Mitre link : CVE-2023-0458

CVE.ORG link : CVE-2023-0458

JSON object : View

Products Affected

linux

  • linux_kernel

debian

  • debian_linux
CWE
CWE-476

NULL Pointer Dereference