Lucene search

GoogleCVE-2023-6931

HistoryDec 19, 2023 - 2:15 p.m.

CVE-2023-6931

2023-12-1914:15:08

CWE-787

Google

web.nvd.nist.gov

linux kernel

cve-2023-6931

heap out-of-bounds write

local privilege escalation

performance events

vulnerability

nvd

upgrade

commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

Percentile

5.1%

JSON

A heap out-of-bounds write vulnerability in the Linux kernel’s Performance Events system component can be exploited to achieve local privilege escalation.

A perf_event’s read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().

We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

Affected configurations

Nvd

Vulners

Node

linuxlinux_kernelRange4.3–6.7

Node

debiandebian_linuxMatch10.0

VendorProductVersionCPE
linuxlinux_kernel*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
linux	linux_kernel	*	cpe:2.3:o:linux:linux_kernel::::::::

CNA Affected

[
  {
    "vendor": "Linux",
    "product": "Kernel",
    "packageName": "kernel",
    "repo": "https://git.kernel.org",
    "versions": [
      {
        "status": "affected",
        "version": "4.3",
        "lessThan": "6.7",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]