PT-2023-9371 · Linux+3 · Linux Kernel+3

Alexander Egorenkov

+3

·

Published

2023-01-31

·

Updated

2024-09-27

·

CVE-2023-52733

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description The issue is related to the decompressor in the Linux kernel, specifically on the s390 architecture. Historically, calls to decompress() did not specify the out len parameter, expecting no writes beyond the uncompressed kernel image. However, with the inclusion of the zstd library commit, this behavior changed, allowing the decompression code to store literal buffers in the unwritten portion of the destination buffer. Since out len is not set, it is considered unlimited, which might corrupt initrd or ipl reports placed after the decompressor buffer. The size of the uncompressed kernel image is known to the decompressor, so specifying it in the out len parameter resolves the issue.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2024-06930
CVE-2023-52733
OPENSUSE-SU-2024_2189-1
SUSE-SU-2024:2008-1
SUSE-SU-2024:2011-1
SUSE-SU-2024:2019-1
SUSE-SU-2024:2189-1
SUSE-SU-2024:2190-1

Affected Products

Astra Linux
Linux Kernel
Red Os
Suse