CVE-2023-4194

2023-08-0700:00:00

ubuntu.com

linux kernel

tun/tap

network filters

unauthorized access

incomplete fix

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

Percentile

15.7%

JSON

A flaw was found in the Linux kernel’s TUN/TAP functionality. This issue
could allow a local user to bypass network filters and gain unauthorized
access to some resources. The original patches fixing CVE-2023-1076 are
incorrect or incomplete. The problem is that the following upstream commits

a096ccca6e50 (“tun: tun_chr_open(): correctly initialize socket uid”), -
66b2c338adce (“tap: tap_open(): correctly initialize socket uid”), pass
“inode->i_uid” to sock_init_data_uid() as the last parameter and that turns
out to not be accurate.

Bugs

Notes

Author	Note
rodrigo-zaiden	incomplete fix from CVE-2023-1076.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchlinux< 5.4.0-164.181UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-86.96UNKNOWN
ubuntu23.04noarchlinux< 6.2.0-34.34UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1111.120UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1047.52UNKNOWN
ubuntu23.04noarchlinux-aws< 6.2.0-1013.13UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1047.52~20.04.1UNKNOWN
ubuntu18.04noarchlinux-aws-5.4< 5.4.0-1111.120~18.04.1UNKNOWN
ubuntu22.04noarchlinux-aws-6.2< 6.2.0-1013.13~22.04.1UNKNOWN
ubuntu20.04noarchlinux-azure< 5.4.0-1117.124UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	linux	< 5.4.0-164.181	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-86.96	UNKNOWN
ubuntu	23.04	noarch	linux	< 6.2.0-34.34	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< 5.4.0-1111.120	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1047.52	UNKNOWN
ubuntu	23.04	noarch	linux-aws	< 6.2.0-1013.13	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< 5.15.0-1047.52~20.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-aws-5.4	< 5.4.0-1111.120~18.04.1	UNKNOWN
ubuntu	22.04	noarch	linux-aws-6.2	< 6.2.0-1013.13~22.04.1	UNKNOWN
ubuntu	20.04	noarch	linux-azure	< 5.4.0-1117.124	UNKNOWN