CVE-2023-0459 Copy_from_user Spectre-V1 Gadget in Linux Kernel

2023-05-2513:22:38

CWE-763

Google

www.cve.org

exploit bypass access_ok

information leakage

kernel pointer vulnerability

linux kernel security

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the “access_ok” check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "packageName": "kernel",
    "platforms": [
      "64 bit"
    ],
    "product": "Linux Kernel",
    "repo": "https://git.kernel.org",
    "vendor": "Linux",
    "versions": [
      {
        "lessThanOrEqual": "74e19ef0ff8061ef55957c3abd71614ef0f42f47",
        "status": "affected",
        "version": "4b842e4e25b12951fa10dedb4bc16bc47e3b850c",
        "versionType": "git"
      }
    ]
  }
]