CVE-2023-3812High· 7.8▾ TwilightAn out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate their privileges on the system.
kernel-rt (all versions)kernel (all versions)kpatch-patchkpatch-patchkernel (all versions)kernel (all versions)kernel-rt (all versions)kernel (all versions)kpatch-patchkernel (all versions)kernel (all versions)kernel-rt (all versions)kernel (all versions)kernel (all versions)kpatch-patchkpatch-patchkernel (all versions)kpatch-patchkernel (all versions)kernel (all versions)kpatch-patchkernel (all versions)kernel (all versions)kernel-rt (all versions)kpatch-patchkernel (all versions)kernel-rt (all versions)kpatch-patchkernel (all versions)kernelkernelkernel-rtkernel-rt (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
To mitigate this issue, prevent the tun module from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-3567High· 7.1Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race
CVE-2023-4732Medium· 4.7Kernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.h
CVE-2023-4132Medium· 5.5Kernel: smsusb: use-after-free caused by do_submit_urb()
CVE-2023-5633High· 7.8Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling
CVE-2023-4133Medium· 5.5Kernel: cxgb4: use-after-free in ch_flower_stats_cb()
CVE-2023-39198High· 7.5Kernel: qxl: race condition leading to use-after-free in qxl_mode_dumb_create()