PT-2023-2689 · Linux+7 · Linux Kernel+7
Jordy Zomer
·
Publicado
2018-04-06
·
Atualizado
2023-09-08
·
CVE-2023-0459
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to the commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47
Description
The issue is related to the
copy from user function in the Linux kernel, which does not implement the uaccess begin nospec feature. This allows a user to bypass the "access ok" check and pass a kernel pointer to copy from user(), potentially leading to information leakage. An attacker could exploit this to access protected memory from a program without the necessary privileges by creating conditions for incorrect branch prediction.Recommendations
Upgrade beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47 to resolve the issue. As a temporary workaround, consider restricting access to the
copy from user function until a patch is available.Correção
Side Channel Attack
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Suse
Ubuntu