PT-2023-9741 · Linux+3 · Linux Kernel+3

Published

2023-11-20

·

Updated

2025-02-03

·

CVE-2023-52842

CVSS v3.1

7.1

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.0-rc3
Description The issue is related to the virtio/vsock component of the Linux kernel. It occurs because the buf alloc and fwd cnt fields of the struct virtio vsock hdr are not initialized when a new skb is allocated in virtio transport init hdr(). This can lead to an uninit-value access issue, as reported by KMSAN. The vulnerability can be exploited by creating a socket with the AF VSOCK family and connecting to a specific address, which can cause the kernel to access uninitialized memory.
Recommendations To resolve this issue, update the Linux kernel to a version that includes the fix for the virtio/vsock vulnerability. Specifically, versions 6.6.0-rc3 and later should include the necessary patch to initialize the buf alloc and fwd cnt fields during skb allocation.
As a temporary workaround, consider disabling the virtio/vsock feature until a patched kernel version is available. However, this may have implications for virtual socket functionality and should be carefully evaluated before implementation.
Note: The provided information does not specify the exact version where the fix is included, but it mentions that the issue is resolved in version 6.6.0-rc3. Therefore, updating to this version or later should mitigate the vulnerability.

Exploit

Fix

Use of Uninitialized Resource

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2024-10406
CVE-2023-52842
SUSE-SU-2024:2571-1
SUSE-SU-2024:2896-1
SUSE-SU-2024:2973-1
SUSE-SU-2025:20008-1
SUSE-SU-2025:20028-1

Affected Products

Astra Linux
Linux Kernel
Red Os
Suse