Buffer overflow in llvm-project - CVE-2023-29932
Published: October 20, 2023
Vulnerability identifier: #VU82278
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-29932
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the component mlir::IROperand
Affected software
llvm-project
VMware Tanzu Application Service for VMs
Isolation Segment
VMware Tanzu Operations Manager
Ubuntu
llvm-13-tools (Ubuntu package)
llvm-13 (Ubuntu package)
mlir-13-tools (Ubuntu package)
llvm-14-tools (Ubuntu package)
llvm-14 (Ubuntu package)
mlir-14-tools (Ubuntu package)
llvm-15 (Ubuntu package)
mlir-15-tools (Ubuntu package)
llvm-15-tools (Ubuntu package)
VMware Tanzu Application Service for VMs
Isolation Segment
VMware Tanzu Operations Manager
Ubuntu
llvm-13-tools (Ubuntu package)
llvm-13 (Ubuntu package)
mlir-13-tools (Ubuntu package)
llvm-14-tools (Ubuntu package)
llvm-14 (Ubuntu package)
mlir-14-tools (Ubuntu package)
llvm-15 (Ubuntu package)
mlir-15-tools (Ubuntu package)
llvm-15-tools (Ubuntu package)
How to mitigate CVE-2023-29932
Install updates from vendor's website.
llvm-project - update to 17.0.3
VMware Tanzu Application Service for VMs - addressed in versions 3.0.15, 4.0.6
Isolation Segment - addressed in versions 3.0.15, 4.0.6
VMware Tanzu Operations Manager - update to 3.0.15
llvm-13-tools (Ubuntu package) - addressed in versions 1:13.0.1-2ubuntu2.2, 1:13.0.1-11ubuntu14.1
llvm-13 (Ubuntu package) - addressed in versions 1:13.0.1-2ubuntu2.2, 1:13.0.1-11ubuntu14.1
mlir-13-tools (Ubuntu package) - addressed in versions 1:13.0.1-2ubuntu2.2, 1:13.0.1-11ubuntu14.1
llvm-14-tools (Ubuntu package) - addressed in versions 1:14.0.0-1ubuntu1.1, 1:14.0.6-12ubuntu0.23.04.1
llvm-14 (Ubuntu package) - addressed in versions 1:14.0.0-1ubuntu1.1, 1:14.0.6-12ubuntu0.23.04.1
mlir-14-tools (Ubuntu package) - addressed in versions 1:14.0.0-1ubuntu1.1, 1:14.0.6-12ubuntu0.23.04.1
llvm-15 (Ubuntu package) - addressed in versions 1:15.0.7-0ubuntu0.22.04.3, 1:15.0.7-3ubuntu0.23.04.1
mlir-15-tools (Ubuntu package) - addressed in versions 1:15.0.7-0ubuntu0.22.04.3, 1:15.0.7-3ubuntu0.23.04.1
llvm-15-tools (Ubuntu package) - addressed in versions 1:15.0.7-0ubuntu0.22.04.3, 1:15.0.7-3ubuntu0.23.04.1
VMware Tanzu Application Service for VMs - addressed in versions 3.0.15, 4.0.6
Isolation Segment - addressed in versions 3.0.15, 4.0.6
VMware Tanzu Operations Manager - update to 3.0.15
llvm-13-tools (Ubuntu package) - addressed in versions 1:13.0.1-2ubuntu2.2, 1:13.0.1-11ubuntu14.1
llvm-13 (Ubuntu package) - addressed in versions 1:13.0.1-2ubuntu2.2, 1:13.0.1-11ubuntu14.1
mlir-13-tools (Ubuntu package) - addressed in versions 1:13.0.1-2ubuntu2.2, 1:13.0.1-11ubuntu14.1
llvm-14-tools (Ubuntu package) - addressed in versions 1:14.0.0-1ubuntu1.1, 1:14.0.6-12ubuntu0.23.04.1
llvm-14 (Ubuntu package) - addressed in versions 1:14.0.0-1ubuntu1.1, 1:14.0.6-12ubuntu0.23.04.1
mlir-14-tools (Ubuntu package) - addressed in versions 1:14.0.0-1ubuntu1.1, 1:14.0.6-12ubuntu0.23.04.1
llvm-15 (Ubuntu package) - addressed in versions 1:15.0.7-0ubuntu0.22.04.3, 1:15.0.7-3ubuntu0.23.04.1
mlir-15-tools (Ubuntu package) - addressed in versions 1:15.0.7-0ubuntu0.22.04.3, 1:15.0.7-3ubuntu0.23.04.1
llvm-15-tools (Ubuntu package) - addressed in versions 1:15.0.7-0ubuntu0.22.04.3, 1:15.0.7-3ubuntu0.23.04.1