CVE-2023-6931 Out-of-bounds write in Linux kernel's Performance Events system component

2023-12-1914:09:14

CWE-787

Google

www.cve.org

cve-2023-6931

linux kernel

performance events

out-of-bounds write

heap

local privilege escalation

upgrade

commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

A heap out-of-bounds write vulnerability in the Linux kernel’s Performance Events system component can be exploited to achieve local privilege escalation.

A perf_event’s read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group().

We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

CNA Affected

[
  {
    "vendor": "Linux",
    "product": "Kernel",
    "packageName": "kernel",
    "repo": "https://git.kernel.org",
    "versions": [
      {
        "status": "affected",
        "version": "4.3",
        "lessThan": "6.7",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]