CVE-2023-3090

2023-07-0418:17:09

redhat.com

access.redhat.com

ipvlan network driver

linux kernel

flaw

stack overflow

denial of service

local privilege escalation

mitigation

blacklist kernel module

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

A flaw was found in the IPVLAN network driver in the Linux kernel. This issue is caused by missing skb->cb initialization in __ip_options_echo and can lead to an out-of-bounds write stack overflow. This may allow a local user to cause a denial of service or potentially achieve local privilege escalation.

Mitigation

This flaw can be mitigated by preventing the affected ipvlan kernel module from being loaded. For instructions on how to blacklist a kernel module, please see <https://access.redhat.com/solutions/41278>.