CVE-2023-28327

2023-04-1923:15:07

CWE-476

[email protected]

web.nvd.nist.gov

cve-2023-28327

unix protocol

net

diag.c

linux kernel

null pointer

local user

denial of service

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

5.7

Confidence

High

EPSS

Percentile

5.1%

JSON

A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service.

Affected configurations

NVD

Node

linuxlinux_kernelRange<6.0

Node

redhatenterprise_linuxMatch8.0

redhatenterprise_linuxMatch9.0

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "Linux",
    "versions": [
      {
        "version": "Linux",
        "status": "affected"
      }
    ]
  }
]