CVE-2023-3090
A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.49%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A heap out-of-bounds write vulnerability in the Linux Kernel ipvlan network driver can be exploited to achieve local privilege escalation. The out-of-bounds write is caused by missing skb->cb initialization in the ipvlan network driver. The vulnerability is reachable if CONFIG_IPVLAN is enabled. We recommend upgrading past commit 90cbed5247439a966b645b34eb0a2e037836ea8e.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.49% probability · 41th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- linux/linux kernel · debian/debian linux
- Source
- cve-coordination@google.com
References
- http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.htmlThird Party Advisory, VDB Entry
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=90cbed5247439a966b645b34eb0a2e037836ea8eExploit, Mailing List, Patch
- https://kernel.dance/90cbed5247439a966b645b34eb0a2e037836ea8ePatch
- https://lists.debian.org/debian-lts-announce/2023/07/msg00030.htmlMailing List
- https://lists.debian.org/debian-lts-announce/2023/10/msg00027.htmlMailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230731-0002/Third Party Advisory
- https://www.debian.org/security/2023/dsa-5448Third Party Advisory
- https://www.debian.org/security/2023/dsa-5480Third Party Advisory
- http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.htmlThird Party Advisory, VDB Entry
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=90cbed5247439a966b645b34eb0a2e037836ea8eExploit, Mailing List, Patch
- https://kernel.dance/90cbed5247439a966b645b34eb0a2e037836ea8ePatch
- https://lists.debian.org/debian-lts-announce/2023/07/msg00030.htmlMailing List
- https://lists.debian.org/debian-lts-announce/2023/10/msg00027.htmlMailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20230731-0002/Third Party Advisory
- https://www.debian.org/security/2023/dsa-5448Third Party Advisory
- https://www.debian.org/security/2023/dsa-5480Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.