Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-44466
HistorySep 29, 2023 - 12:00 a.m.

CVE-2023-44466

2023-09-2900:00:00
ubuntu.com
ubuntu.com
21
linux kernel
buffer overflow
remote code execution
tcp packet
integer signedness error

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

69.2%

An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel
before 6.4.5. There is an integer signedness error, leading to a buffer
overflow and remote code execution via HELLO or one of the AUTH frames.
This occurs because of an untrusted length taken from a TCP packet in
ceph_decode_32.

Bugs

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchlinux< 5.15.0-86.96UNKNOWN
ubuntu23.04noarchlinux< 6.2.0-36.37UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1047.52UNKNOWN
ubuntu23.04noarchlinux-aws< 6.2.0-1015.15UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1047.52~20.04.1UNKNOWN
ubuntu22.04noarchlinux-aws-6.2< 6.2.0-1015.15~22.04.1UNKNOWN
ubuntu22.04noarchlinux-azure< 5.15.0-1049.56UNKNOWN
ubuntu23.04noarchlinux-azure< 6.2.0-1016.16UNKNOWN
ubuntu20.04noarchlinux-azure-5.15< 5.15.0-1049.56~20.04.1UNKNOWN
ubuntu22.04noarchlinux-azure-6.2< 6.2.0-1016.16~22.04.1UNKNOWN
Rows per page:
1-10 of 461

References

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

69.2%