PT-2023-2689 · Linux+7 · Linux Kernel+7

Jordy Zomer · Published 2018-04-06 · Updated 2023-09-08 · CVE-2023-0459

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47

Description The issue is related to the copy from user function in the Linux kernel, which does not implement the uaccess begin nospec feature. This allows a user to bypass the "access ok" check and pass a kernel pointer to copy from user(), potentially leading to information leakage. An attacker could exploit this to access protected memory from a program without the necessary privileges by creating conditions for incorrect branch prediction.

Recommendations Upgrade beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47 to resolve the issue. As a temporary workaround, consider restricting access to the copy from user function until a patch is available.

Fix

Side Channel Attack

Information Disclosure

Weakness Enumeration

CWE-264

CWE-763

CWE-203

CWE-200

Related Identifiers

ALT-PU-2018-1557

ALT-PU-2019-1139

ALT-PU-2019-1363

ALT-PU-2020-1145

ALT-PU-2020-1251

ALT-PU-2020-2164

ALT-PU-2021-1447

ALT-PU-2021-1525

ALT-PU-2021-1869

ALT-PU-2021-1888

ALT-PU-2021-1896

ALT-PU-2022-1175

ALT-PU-2022-1647

ALT-PU-2022-2155

ALT-PU-2023-1344

ALT-PU-2023-1346

ALT-PU-2023-1355

ALT-PU-2023-1358

ALT-PU-2023-1372

ALT-PU-2023-1373

ALT-PU-2023-1378

ALT-PU-2023-1407

ALT-PU-2023-1409

ALT-PU-2023-1497

ALT-PU-2023-1503

AZL-26953

BDU:2023-02532

CESA-2022_1975

CESA-2022_1988

CVE-2023-0459

DLA-3403-1

DLA-3404-1

OESA-2023-1284

OPENSUSE-SU-2023_3302-1

OPENSUSE-SU-2023_3311-1

OPENSUSE-SU-2023_3313-1

OPENSUSE-SU-2023_3318-1

OPENSUSE-SU-2023_3376-1

OPENSUSE-SU-2023_3377-1

OPENSUSE-SU-2023_3391-1

OPENSUSE-SU-2023_3392-1

RHSA-2022:1975

RHSA-2022:1988

RHSA-2022_1975

RHSA-2022_1988

SUSE-SU-2023:3302-1

SUSE-SU-2023:3309-1

SUSE-SU-2023:3311-1

SUSE-SU-2023:3313-1

SUSE-SU-2023:3318-1

SUSE-SU-2023:3324-1

SUSE-SU-2023:3329-1

SUSE-SU-2023:3333-1

SUSE-SU-2023:3349-1

SUSE-SU-2023:3376-1

SUSE-SU-2023:3377-1

SUSE-SU-2023:3390-1

SUSE-SU-2023:3391-1

SUSE-SU-2023:3392-1

SUSE-SU-2023:3421-1

USN-6079-1

USN-6080-1

USN-6081-1

USN-6084-1

USN-6085-1

USN-6090-1

USN-6091-1

USN-6092-1

USN-6094-1

USN-6095-1

USN-6096-1

USN-6109-1

USN-6118-1

USN-6132-1

USN-6133-1

USN-6134-1

USN-6174-1

USN-6222-1

USN-6235-1

USN-6256-1

Affected Products

Alt Linux

Astra Linux

Centos

Linuxmint

Linux Kernel

Red Hat

Suse

Ubuntu

References · 410

• https://github.com/torvalds/linux/commit/4b842e4e25b12951fa10dedb4bc16bc47e3b850c · Patch
• https://github.com/torvalds/linux/commit/74e19ef0ff8061ef55957c3abd71614ef0f42f47 · Patch
• https://ubuntu.com/security/CVE-2023-0210 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0458 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-20938 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6109-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6133-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2177 · Security Note
• https://osv.dev/vulnerability/DLA-3403-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-31436 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48424 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-2124 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0394 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0458 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:3377-1 · Vendor Advisory