Out-of-bounds read in Linux kernel - CVE-2023-34256

Vulnerability identifier: #VU77624

CSH Severity: Low

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-34256

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition within crc16 in lib/crc16.c when called from fs/ext4/super.c. A local user can trigger an out-of-bounds read error and crash the kernel.

Linux kernel
Amazon Linux AMI
Anolis OS
Ubuntu
Slackware Linux
openEuler
Oracle VM Server for x86
IBM Cloud Object Storage Systems
linux-image-oem (Ubuntu package)
linux-image-aws-lts-18.04 (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-oracle-lts-18.04 (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-generic-hwe-16.04 (Ubuntu package)
linux-image-lowlatency-hwe-16.04 (Ubuntu package)
linux-image-4.15.0-223-lowlatency (Ubuntu package)
linux-image-virtual-hwe-16.04 (Ubuntu package)
linux-image-gcp-lts-18.04 (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-gke (Ubuntu package)
linux-image-4.4.0-1167-aws (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-4.15.0-1175-azure (Ubuntu package)
linux-image-azure-lts-18.04 (Ubuntu package)
linux-image-4.4.0-252-lowlatency (Ubuntu package)
linux-image-4.4.0-252-generic (Ubuntu package)
linux-image-4.4.0-1130-kvm (Ubuntu package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-4.15.0-1160-gcp (Ubuntu package)
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-4.4.0-1129-aws (Ubuntu package)
linux-image-4.15.0-1129-oracle (Ubuntu package)
linux-image-4.15.0-1150-kvm (Ubuntu package)
linux-image-4.15.0-1166-aws (Ubuntu package)
linux-image-4.15.0-223-generic (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-aws-hwe (Ubuntu package)
kernel
python3-perf-debuginfo
perf
kernel-debuginfo
kernel-tools-debuginfo
python2-perf-debuginfo
kernel-tools
kernel-devel
perf-debuginfo
bpftool
kernel-debugsource
bpftool-debuginfo
python2-perf
kernel-source
kernel-tools-devel
python3-perf
kernel-tools-libs
kernel-headers
kernel-tools-libs-devel
kernel-debug
kernel-debug-devel
python-perf
kernel-modules-internal
kernel-modules-extra
kernel-modules
kernel-debug-modules-extra
kernel-debug-modules
kernel-debug-core
kernel-core
linux-5.15.118/kernel-modules
linux-5.15.118/kernel-huge
linux-5.15.118/kernel-generic
linux-5.15.118/kernel-headers

Install updates from vendor's website.

Linux kernel - update to 6.3.3
linux-image-oem (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-aws-lts-18.04 (Ubuntu package) - update to Ubuntu Pro
linux-image-generic (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-kvm (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-lowlatency (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-oracle-lts-18.04 (Ubuntu package) - update to Ubuntu Pro
linux-image-virtual (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-generic-hwe-16.04 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-lowlatency-hwe-16.04 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.15.0-223-lowlatency (Ubuntu package) - update to Ubuntu Pro
linux-image-virtual-hwe-16.04 (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-gcp-lts-18.04 (Ubuntu package) - update to Ubuntu Pro
linux-image-gcp (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-gke (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.4.0-1167-aws (Ubuntu package) - update to Ubuntu Pro
linux-image-aws (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.15.0-1175-azure (Ubuntu package) - update to Ubuntu Pro
linux-image-azure-lts-18.04 (Ubuntu package) - update to Ubuntu Pro
linux-image-4.4.0-252-lowlatency (Ubuntu package) - update to Ubuntu Pro
linux-image-4.4.0-252-generic (Ubuntu package) - update to Ubuntu Pro
linux-image-4.4.0-1130-kvm (Ubuntu package) - update to Ubuntu Pro
linux-image-generic-lts-xenial (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.15.0-1160-gcp (Ubuntu package) - update to Ubuntu Pro
linux-image-virtual-lts-xenial (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-4.4.0-1129-aws (Ubuntu package) - update to Ubuntu Pro
linux-image-4.15.0-1129-oracle (Ubuntu package) - update to Ubuntu Pro
linux-image-4.15.0-1150-kvm (Ubuntu package) - update to Ubuntu Pro
linux-image-4.15.0-1166-aws (Ubuntu package) - update to Ubuntu Pro
linux-image-4.15.0-223-generic (Ubuntu package) - update to Ubuntu Pro
linux-image-azure (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-oracle (Ubuntu package) - update to Ubuntu Pro (Infra-only)
linux-image-aws-hwe (Ubuntu package) - update to Ubuntu Pro (Infra-only)
IBM Cloud Object Storage Systems - addressed in versions 3.17.0.121, 3.17.5.79
kernel - addressed in versions 4.14.318-166.529, 6.1.29-47.49
python3-perf-debuginfo - addressed in versions 4.19.90-2306.7.0.0208, 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
kernel - addressed in versions 4.19.90-2306.7.0.0208, 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
perf - addressed in versions 4.19.90-2306.7.0.0208, 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
kernel-debuginfo - addressed in versions 4.19.90-2306.7.0.0208, 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
kernel-tools-debuginfo - addressed in versions 4.19.90-2306.7.0.0208, 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
python2-perf-debuginfo - update to 4.19.90-2306.7.0.0208
kernel-tools - addressed in versions 4.19.90-2306.7.0.0208, 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
kernel-devel - addressed in versions 4.19.90-2306.7.0.0208, 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
perf-debuginfo - addressed in versions 4.19.90-2306.7.0.0208, 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
bpftool - addressed in versions 4.19.90-2306.7.0.0208, 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
kernel-debugsource - addressed in versions 4.19.90-2306.7.0.0208, 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
bpftool-debuginfo - addressed in versions 4.19.90-2306.7.0.0208, 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
python2-perf - update to 4.19.90-2306.7.0.0208
kernel-source - addressed in versions 4.19.90-2306.7.0.0208, 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
kernel-tools-devel - addressed in versions 4.19.90-2306.7.0.0208, 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
python3-perf - addressed in versions 4.19.90-2306.7.0.0208, 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
kernel-tools-libs - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel-tools - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel-headers - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel-tools-libs-devel - addressed in versions 4.19.91-27.6, 4.19.91-28
perf - addressed in versions 4.19.91-27.6, 4.19.91-28
bpftool - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel-debug - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel-debug-devel - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel-devel - addressed in versions 4.19.91-27.6, 4.19.91-28
python-perf - addressed in versions 4.19.91-27.6, 4.19.91-28
python3-perf - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel-modules-internal - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel-modules-extra - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel-modules - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel-debug-modules-extra - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel-debug-modules - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel-debug-core - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel-core - addressed in versions 4.19.91-27.6, 4.19.91-28
kernel-headers - addressed in versions 5.10.0-60.101.0.126, 5.10.0-136.39.0.116, 5.10.0-153.17.0.93
linux-5.15.118/kernel-modules - update to 5.15.118
linux-5.15.118/kernel-huge - update to 5.15.118
linux-5.15.118/kernel-generic - update to 5.15.118
linux-5.15.118/kernel-headers - update to 5.15.118_smp

• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f04351888a83e595571de672e0a4a8b74f4fb31
• https://syzkaller.appspot.com/bug?extid=8785e41224a3afd04321
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.3
• https://bugzilla.suse.com/show_bug.cgi?id=1211895

• Local denial of service in Linux kernel crc16
• Slackware Linux update for kernel
• Amazon Linux AMI update for kernel
• Multiple vulnerabilities in Oracle VM Server for x86
• Multiple vulnerabilities in IBM Cloud Object System
• openEuler 20.03 LTS SP3 update for kernel
• openEuler 22.03 LTS update for kernel
• openEuler 22.03 LTS SP1 update for kernel
• openEuler 22.03 LTS SP2 update for kernel
• openEuler 20.03 LTS SP1 update for kernel
• Ubuntu update for linux
• Ubuntu update for linux
• Ubuntu update for linux-gcp
• Ubuntu update for linux-aws
• Ubuntu update for linux-aws-hwe
• Ubuntu update for linux-azure
• Amazon Linux AMI update for kernel
• Anolis OS update for kernel(ANCK)4.19
• Anolis OS update for kernel
• Anolis OS update for kernel
• Anolis OS update for kernel