The vulnerability of the extract_user_to_sg() function in the lib/scatterlist.c module of the scatterlist library in the Linux operating system allows a attacker to compromise the integrity and accessibility of the protected information.

🗓️ 21 Oct 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 10 Views

Vulnerability in extract_user_to_sg() in Linux scatterlist library risks mismanagement and data access.

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2023-40791	16 Oct 202303:15	–	attackerkb
CBLMariner	CVE-2023-40791 affecting package kernel for versions less than 5.15.135.1-2	8 Nov 202302:07	–	cbl_mariner
CNNVD	Linux kernel security vulnerabilities	16 Oct 202300:00	–	cnnvd
CVE	CVE-2023-40791	16 Oct 202300:00	–	cve
Cvelist	CVE-2023-40791	16 Oct 202300:00	–	cvelist
Debian CVE	CVE-2023-40791	16 Oct 202300:00	–	debiancve
Microsoft CVE	extract_user_to_sg in lib/scatterlist.c in the Linux kernel before 6.4.12 fails to unpin pages in a certain situation as demonstrated by a WARNING for try_grab_page.	20 Oct 202307:00	–	mscve
NVD	CVE-2023-40791	16 Oct 202303:15	–	nvd
OSV	AZL-31564 CVE-2023-40791 affecting package kernel for versions less than 5.15.135.1-2	16 Oct 202303:15	–	osv
OSV	BELL-CVE-2023-40791 CVE-2023-40791 does not affect BellSoft software	16 Oct 202303:15	–	osv

Source	Link
lkml	www.lkml.org/lkml/2023/8/3/323
git	www.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/
lore	www.lore.kernel.org/linux-crypto/[email protected]/
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
git	www.git.kernel.org/linus/f443fd5af5dbd531f880d3645d5dd36976cf087f
kernel	www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.12
web	www.web.nvd.nist.gov/view/vuln/detail

09 Jan 2024 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 25.5

CVSS 36.3

EPSS0.00448

extract_user_to_sg linux scatterlist library memory mismanagement data access information integrity