CVE-2023-52464

2024-02-2300:00:00

ubuntu.com

linux kernel

vulnerability

cve-2023-52464

resolved

out-of-bounds string access

edac/thunderx

strncat

strlcat

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

Percentile

5.1%

JSON

In the Linux kernel, the following vulnerability has been resolved:
EDAC/thunderx: Fix possible out-of-bounds string access Enabling
-Wstringop-overflow globally exposes a warning for a common bug in the
usage of strncat(): drivers/edac/thunderx_edac.c: In function
‘thunderx_ocx_com_threaded_isr’: drivers/edac/thunderx_edac.c:1136:17:
error: ‘strncat’ specified bound 1024 equals destination size
[-Werror=stringop-overflow=] 1136 | strncat(msg, other, OCX_MESSAGE_SIZE);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ … 1145 | strncat(msg, other,
OCX_MESSAGE_SIZE); … 1150 | strncat(msg, other, OCX_MESSAGE_SIZE); …
Apparently the author of this driver expected strncat() to behave the way
that strlcat() does, which uses the size of the destination buffer as its
third argument rather than the length of the source buffer. The result is
that there is no check on the size of the allocated buffer. Change it to
strlcat(). [ bp: Trim compiler output, fixup commit message. ]

Notes

Author	Note
rodrigo-zaiden	USN-6765-1 for linux-oem-6.5 wrongly stated that this CVE was fixed in version 6.5.0-1022.23. The mentioned notice was revoked and the state of the fix for linux-oem-6.5 was recovered to the previous state.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlinux< 4.15.0-224.236UNKNOWN
ubuntu20.04noarchlinux< 5.4.0-176.196UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-102.112UNKNOWN
ubuntu23.10noarchlinux< 6.5.0-41.41UNKNOWN
ubuntu18.04noarchlinux-aws< 4.15.0-1167.180UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1122.132UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1057.63UNKNOWN
ubuntu23.10noarchlinux-aws< 6.5.0-1021.21UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1057.63~20.04.1UNKNOWN
ubuntu18.04noarchlinux-aws-5.4< 5.4.0-1122.132~18.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	linux	< 4.15.0-224.236	UNKNOWN
ubuntu	20.04	noarch	linux	< 5.4.0-176.196	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-102.112	UNKNOWN
ubuntu	23.10	noarch	linux	< 6.5.0-41.41	UNKNOWN
ubuntu	18.04	noarch	linux-aws	< 4.15.0-1167.180	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< 5.4.0-1122.132	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1057.63	UNKNOWN
ubuntu	23.10	noarch	linux-aws	< 6.5.0-1021.21	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< 5.15.0-1057.63~20.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-aws-5.4	< 5.4.0-1122.132~18.04.1	UNKNOWN