Bug 2226788 (CVE-2023-39194, ZDI-CAN-18111) - CVE-2023-39194 kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()
Summary: CVE-2023-39194 kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()
Keywords:
Status: NEW
Alias: CVE-2023-39194, ZDI-CAN-18111
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2227302 2227303 2227304 2227305 2242892
Blocks: 2225771
TreeView+ depends on / blocked
 
Reported: 2023-07-26 14:29 UTC by Mauro Matteo Cascella
Modified: 2024-05-22 09:51 UTC (History)
50 users (show)

Fixed In Version: kernel 6.5-rc7
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:2634 0 None None None 2024-05-01 01:22:01 UTC
Red Hat Product Errata RHBA-2024:2650 0 None None None 2024-05-02 00:14:49 UTC
Red Hat Product Errata RHBA-2024:2686 0 None None None 2024-05-02 22:49:57 UTC
Red Hat Product Errata RHSA-2024:2394 0 None None None 2024-04-30 10:11:20 UTC
Red Hat Product Errata RHSA-2024:2950 0 None None None 2024-05-22 09:14:26 UTC
Red Hat Product Errata RHSA-2024:3138 0 None None None 2024-05-22 09:51:23 UTC

Description Mauro Matteo Cascella 2023-07-26 14:29:19 UTC 
An out-of-bounds read issue was found in the __xfrm_state_filter_match() function within the XFRM subsystem of the Linux kernel. This flaw requires CAP_NET_ADMIN to be exploited and could lead to information disclosure.
Comment 6 Mauro Matteo Cascella 2023-10-09 07:36:29 UTC 
ZDI security advisory:
https://www.zerodayinitiative.com/advisories/ZDI-CAN-18111/

Upstream fix:
https://github.com/torvalds/linux/commit/dfa73c17d55b921e1d4e154976de35317e43a93a
Comment 7 Mauro Matteo Cascella 2023-10-09 15:45:59 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2242892]
Comment 8 Justin M. Forbes 2023-10-12 16:39:04 UTC 
This was fixed for Fedora with the 6.4.12 stable kernels
Comment 9 errata-xmlrpc 2024-04-30 10:11:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2394 https://access.redhat.com/errata/RHSA-2024:2394
Comment 10 errata-xmlrpc 2024-05-22 09:14:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:2950 https://access.redhat.com/errata/RHSA-2024:2950
Comment 11 errata-xmlrpc 2024-05-22 09:51:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:3138 https://access.redhat.com/errata/RHSA-2024:3138
Note You need to log in before you can comment on or make changes to this bug.