PT-2023-6490 · Linux+8 · Linux Kernel+8
Tom Dohrmann
·
Publicado
2023-10-09
·
Atualizado
2025-11-11
·
CVE-2023-46813
CVSS v3.1
7.0
Alta
| Vetor | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.5.9
Description
The issue is caused by errors in synchronization when using a shared resource, potentially allowing an attacker to execute arbitrary code. It involves incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses, which could lead to arbitrary write access to kernel memory and thus privilege escalation. This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.
Recommendations
For Linux kernel versions prior to 6.5.9, update to version 6.5.9 or later to resolve the issue. As a temporary workaround, consider restricting access to MMIO registers to minimize the risk of exploitation. Avoid using the #VC handler and SEV-ES emulation of MMIO accesses in sensitive operations until the issue is resolved.
Exploit
Correção
Race Condition
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Suse
Ubuntu