PT-2023-9216 · Xnio+1 · Xnio+1

Patrick Del Bello · Published 2023-04-12 · Updated 2024-11-26 · CVE-2023-5685

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions XNIO versions prior to 3.8.14.Final

Description A flaw was found in XNIO, specifically in the NotifierState, which can cause a Stack Overflow Exception when the chain of notifier states becomes large. This can lead to uncontrolled resource management and a possible denial of service (DoS). The issue is related to uncontrolled resource consumption in the NotifierState, allowing a remote attacker to cause a denial of service.

Recommendations For versions prior to 3.8.14.Final, update to version 3.8.14.Final to resolve the issue. As a temporary workaround, consider restricting the size of the notifier state chain to prevent the Stack Overflow Exception.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2024-04794

CVE-2023-5685

GHSA-7F88-5HHX-67M2

RHSA-2023:7637

RHSA-2023:7638

RHSA-2023:7639

RHSA-2024:10207

RHSA-2024:10208

Affected Products

Debian

Xnio

References · 29

• https://access.redhat.com/errata/RHSA-2024:10207 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7641 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7639 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7f88-5hhx-67m2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-5685 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:10208 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-5685 · Security Note
• https://bdu.fstec.ru/vul/2024-04794 · Security Note
• https://access.redhat.com/errata/RHSA-2023:7637 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-5685 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-5685 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-5685 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:2707 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:7638 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-5685 · Vendor Advisory