Out-of-bounds read in Linux kernel - CVE-2023-26607

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU74125

Out-of-bounds read in Linux kernel - CVE-2023-26607

Published: March 28, 2023


Vulnerability identifier: #VU74125
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-26607
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the ntfs_attr_find() function in fs/ntfs/attrib.c in Linux kernel. A local user can trigger an out-of-bounds read error and read contents of memory on the system.


Affected software

Linux kernel
Anolis OS
Ubuntu
openEuler
linux-image-4.15.0-1146-gcp (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-4.4.0-1118-kvm (Ubuntu package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.4.0-239-generic (Ubuntu package)
linux-image-4.4.0-239-lowlatency (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-4.4.0-1117-aws (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-4.15.0-1162-azure (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-4.4.0-1155-aws (Ubuntu package)
kernel-source
kernel-devel
kernel
python2-perf-debuginfo
python2-perf
bpftool-debuginfo
kernel-debugsource
kernel-tools
kernel-debuginfo
perf-debuginfo
python3-perf-debuginfo
python3-perf
kernel-tools-debuginfo
kernel-tools-devel
perf
bpftool
kernel-tools-libs-devel
python-perf
kernel-debug
kernel-debug-devel
kernel-headers
kernel-tools-libs
kernel-modules-internal
kernel-modules-extra
kernel-modules
kernel-debug-modules-extra
kernel-debug-modules
kernel-debug-core
kernel-core
linux-image-bluefield (Ubuntu package)
linux-image-5.4.0-1059-bluefield (Ubuntu package)
linux-image-oem-22.04a (Ubuntu package)
linux-image-oem-22.04 (Ubuntu package)
linux-image-5.17.0-1030-oem (Ubuntu package)
linux-image-oem-22.04b (Ubuntu package)
linux-image-6.0.0-1014-oem (Ubuntu package)

How to mitigate CVE-2023-26607

Install updates from vendor's website.

linux-image-4.15.0-1146-gcp (Ubuntu package) - update to Ubuntu Pro
linux-image-lowlatency (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-virtual-lts-xenial (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.4.0-1118-kvm (Ubuntu package) - update to Ubuntu Pro
linux-image-generic-lts-xenial (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-kvm (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.4.0-239-generic (Ubuntu package) - update to Ubuntu Pro
linux-image-4.4.0-239-lowlatency (Ubuntu package) - update to Ubuntu Pro
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-generic (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-virtual (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.4.0-1117-aws (Ubuntu package) - update to Ubuntu Pro
linux-image-gcp (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.15.0-1162-azure (Ubuntu package) - update to Ubuntu Pro
linux-image-gke (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-azure (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-aws (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.4.0-1155-aws (Ubuntu package) - update to Ubuntu Pro
kernel-source - addressed in versions 4.19.90-2303.1.0.0191, 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
kernel-devel - addressed in versions 4.19.90-2303.1.0.0191, 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
kernel - addressed in versions 4.19.90-2303.1.0.0191, 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
python2-perf-debuginfo - update to 4.19.90-2303.1.0.0191
python2-perf - update to 4.19.90-2303.1.0.0191
bpftool-debuginfo - addressed in versions 4.19.90-2303.1.0.0191, 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
kernel-debugsource - addressed in versions 4.19.90-2303.1.0.0191, 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
kernel-tools - addressed in versions 4.19.90-2303.1.0.0191, 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
kernel-debuginfo - addressed in versions 4.19.90-2303.1.0.0191, 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
perf-debuginfo - addressed in versions 4.19.90-2303.1.0.0191, 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
python3-perf-debuginfo - addressed in versions 4.19.90-2303.1.0.0191, 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
python3-perf - addressed in versions 4.19.90-2303.1.0.0191, 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
kernel-tools-debuginfo - addressed in versions 4.19.90-2303.1.0.0191, 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
kernel-tools-devel - addressed in versions 4.19.90-2303.1.0.0191, 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
perf - addressed in versions 4.19.90-2303.1.0.0191, 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
bpftool - addressed in versions 4.19.90-2303.1.0.0191, 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
kernel-tools-libs-devel - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
python-perf - addressed in versions 4.19.91-27.5, 4.19.91-28
perf - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
python3-perf - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
bpftool - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
kernel - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
kernel-debug - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
kernel-debug-devel - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
kernel-devel - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
kernel-headers - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
kernel-tools - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
kernel-tools-libs - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
kernel-modules-internal - addressed in versions 4.19.91-27.5, 4.19.91-28
kernel-modules-extra - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
kernel-modules - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
kernel-debug-modules-extra - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
kernel-debug-modules - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
kernel-debug-core - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
kernel-core - addressed in versions 4.19.91-27.5, 4.19.91-28, 5.10.134-15, 5.10.134-16
linux-image-bluefield (Ubuntu package) - update to 5.4.0.1059.54
linux-image-5.4.0-1059-bluefield (Ubuntu package) - update to 5.4.0-1059.65
kernel-headers - addressed in versions 5.10.0-60.84.0.108, 5.10.0-136.22.0.98
linux-image-oem-22.04a (Ubuntu package) - update to 5.17.0.1030.28
linux-image-oem-22.04 (Ubuntu package) - update to 5.17.0.1030.28
linux-image-5.17.0-1030-oem (Ubuntu package) - update to 5.17.0-1030.31
linux-image-oem-22.04b (Ubuntu package) - update to 6.0.0.1014.14
linux-image-6.0.0-1014-oem (Ubuntu package) - update to 6.0.0-1014.14

External References

Related Security Bulletins