PT-2023-9354 · Linux+2 · Linux Kernel+2

Published 2023-11-07 · Updated 2024-09-27 · CVE-2023-52755

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description The issue is related to a slab out-of-bounds write in the smb inherit dacl() function, caused by offsets being larger than the pntsd allocation size. This can lead to unauthorized access to confidential data, disruption of data integrity, and denial of service. The patch adds a check to validate 3 offsets using the allocation size.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

AZL-47639

AZL-47691

BDU:2024-06909

CVE-2023-52755

OESA-2024-1860

OESA-2024-1861

ZDI-24-996

Affected Products

Astra Linux

Linux Kernel

Red Os

References · 59

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52755.json · Exploit
• https://git.kernel.org/stable/c/09d9d8b40a3338193619c14ed4dc040f4f119e70 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-52755 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-36478 · Security Note
• https://bdu.fstec.ru/vul/2024-06909 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38632 · Security Note
• https://osv.dev/vulnerability/CVE-2023-52755 · Vendor Advisory
• https://git.kernel.org/stable/c/712e01f32e577e7e48ab0adb5fe550646a3d93cb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-39488 · Security Note
• https://git.kernel.org/stable/c/aaf0a07d60887d6c36fc46a24de0083744f07819 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-38605 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38586 · Security Note
• https://ubuntu.com/security/CVE-2023-52755 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-40971 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52833 · Security Note