PT-2023-6286 · Linux+4 · Linux Kernel+4

Kees Cook · Published 2023-02-06 · Updated 2024-11-21 · CVE-2023-45862

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.2.5

Description The issue is related to the ms lib process bootblock() function in the ene ub6250.c module of the ENE UB6250 reader driver in the Linux kernel. It is associated with accessing memory beyond the allocated buffer. Exploitation of this issue could allow a remote attacker to cause a denial of service. An object could potentially extend beyond the end of an allocation.

Recommendations For Linux kernel versions prior to 6.2.5, update to version 6.2.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the ene ub6250 driver until a patch is available.

Fix

Buffer Overflow

Allocation of Resources Without Limits

Weakness Enumeration

CWE-119

CWE-770

Related Identifiers

ALT-PU-2024-14046

ALT-PU-2024-6818

AZL-31565

BDU:2023-06997

CVE-2023-45862

OESA-2023-1769

OESA-2023-1770

OESA-2023-1781

OESA-2023-1782

OPENSUSE-SU-2023_4343-1

OPENSUSE-SU-2023_4345-1

OPENSUSE-SU-2023_4347-1

OPENSUSE-SU-2023_4348-1

OPENSUSE-SU-2023_4351-1

OPENSUSE-SU-2023_4414-1

RHSA-2024:0723

RHSA-2024:0724

RHSA-2024:0725

RHSA-2024:1404

SUSE-SU-2023:4343-1

SUSE-SU-2023:4345-1

SUSE-SU-2023:4346-1

SUSE-SU-2023:4347-1

SUSE-SU-2023:4348-1

SUSE-SU-2023:4349-1

SUSE-SU-2023:4351-1

SUSE-SU-2023:4359-1

SUSE-SU-2023:4377-1

SUSE-SU-2023:4414-1

USN-6494-1

USN-6494-2

USN-6532-1

Affected Products

Alt Linux

Astra Linux

Linux Kernel

Suse

Ubuntu

References · 176

• https://osv.dev/vulnerability/UBUNTU-CVE-2023-45862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-32246 · Security Note
• https://ubuntu.com/security/CVE-2023-45862 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2898 · Security Note
• https://ubuntu.com/security/CVE-2023-39194 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2023:4346-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45871 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-45862 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6494-2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-06997 · Security Note
• https://ubuntu.com/security/notices/USN-6494-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1782 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45919 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:4349-1 · Vendor Advisory