PT-2023-32072 · Linux+1 · Linux Kernel+1

David Chisnall · Publicado 2023-10-03 · Atualizado 2023-11-24 · CVE-2023-5369

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue arises from an incorrect privilege check in the copy file range system call, which only verifies the CAP READ and CAP WRITE capabilities on the input and output file descriptors. However, using an offset is equivalent to seeking and requires the CAP SEEK capability. This flaw allows sandboxed processes with limited capabilities to read or write data at arbitrary locations within a file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-273

Identificadores relacionados

CVE-2023-5369

FREEBSD-SA-23_13

Produtos afetados

Freebsd

Linux Kernel

Referências · 7

• https://security.freebsd.org/advisories/FreeBSD-SA-23:13.capsicum.asc · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20231124-0009 · Nota
• https://twitter.com/VulmonFeeds/status/1709442207155925501 · Publicação no Twitter
• https://t.me/cvenotify/61082 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-5369 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1709416460647543030 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-5369 · Nota de Segurança