Lucene search

Redhat.comRH:CVE-2023-6606

HistoryDec 08, 2023 - 7:57 a.m.

CVE-2023-6606

2023-12-0807:57:38

redhat.com

access.redhat.com

out-of-bounds read

smbcalcsize

linux kernel

vulnerability

cve-2023-6606

local attacker

system crash

kernel information

module blacklist

red hat solution

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

6.5 Medium

AI Score

Confidence

High

3.2 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:L/AC:L/Au:S/C:P/I:N/A:P

0.0004 Low

EPSS

Percentile

5.2%

JSON

An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

Mitigation

To mitigate this issue, prevent module cifs from being loaded. Please see <https://access.redhat.com/solutions/41278> for how to blacklist a kernel module to prevent it from loading automatically.