CVE-2023-3772

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-3772
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.

4.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:6583 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6901 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7077 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0412
https://access.redhat.com/errata/RHSA-2024:0575
https://access.redhat.com/security/cve/CVE-2023-3772 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2218943 Issue Tracking Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_real_time:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:8.0:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
History

13 Sep 2024, 19:15

Type Values Removed Values Added
References
  • {'url': 'http://www.openwall.com/lists/oss-security/2023/08/10/1', 'tags': ['Exploit', 'Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'http://www.openwall.com/lists/oss-security/2023/08/10/3', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html', 'source': 'secalert@redhat.com'}
  • {'url': 'https://www.debian.org/security/2023/dsa-5492', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}

30 Jan 2024, 17:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:0575 -

25 Jan 2024, 20:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:0412 -
  • () https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html -

28 Dec 2023, 14:35

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7077 - Third Party Advisory
  • (MISC) https://www.debian.org/security/2023/dsa-5492 - Third Party Advisory
  • () https://access.redhat.com/errata/RHSA-2023:6583 - Third Party Advisory
  • (MISC) https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html - Mailing List, Third Party Advisory
  • () https://access.redhat.com/errata/RHSA-2023:6901 - Third Party Advisory
References (MISC) http://www.openwall.com/lists/oss-security/2023/08/10/1 - (MISC) http://www.openwall.com/lists/oss-security/2023/08/10/1 - Exploit, Mailing List, Third Party Advisory
References (MISC) http://www.openwall.com/lists/oss-security/2023/08/10/3 - (MISC) http://www.openwall.com/lists/oss-security/2023/08/10/3 - Mailing List, Third Party Advisory
CPE cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_real_time:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_real_time_for_nfv:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

10 Aug 2023, 21:15

Type Values Removed Values Added
References
  • (MISC) http://www.openwall.com/lists/oss-security/2023/08/10/1 -
  • (MISC) http://www.openwall.com/lists/oss-security/2023/08/10/3 -

02 Aug 2023, 15:33

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:-:*:*:*:*:*:*:*
CWE CWE-476
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.4
References (MISC) https://access.redhat.com/security/cve/CVE-2023-3772 - (MISC) https://access.redhat.com/security/cve/CVE-2023-3772 - Third Party Advisory
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2218943 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2218943 - Issue Tracking, Third Party Advisory

25 Jul 2023, 17:22

Type Values Removed Values Added
New CVE
Information

Published : 2023-07-25 16:15

Updated : 2024-09-13 19:15

NVD link : CVE-2023-3772

Mitre link : CVE-2023-3772

CVE.ORG link : CVE-2023-3772

JSON object : View

Products Affected

debian

  • debian_linux

redhat

  • enterprise_linux_for_real_time_for_nfv
  • enterprise_linux_for_real_time
  • enterprise_linux

linux

  • linux_kernel

fedoraproject

  • fedora
CWE
CWE-476

NULL Pointer Dereference