CVE-2023-2598
Severity CVSS v4.0:
Pending analysis
Type:
CWE-416
Use After Free
Publication date:
01/06/2023
Last modified:
23/04/2025
Description
A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the Linux kernel that allows out-of-bounds access to physical memory beyond the end of the buffer. This flaw enables full local privilege escalation.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.3 (including) | 6.3.2 (excluding) |
| cpe:2.3:a:netapp:hci_baseboard_management_controller:h300s:*:*:*:*:*:*:* | ||
| cpe:2.3:a:netapp:hci_baseboard_management_controller:h410c:*:*:*:*:*:*:* | ||
| cpe:2.3:a:netapp:hci_baseboard_management_controller:h410s:*:*:*:*:*:*:* | ||
| cpe:2.3:a:netapp:hci_baseboard_management_controller:h500s:*:*:*:*:*:*:* | ||
| cpe:2.3:a:netapp:hci_baseboard_management_controller:h700s:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://www.openwall.com/lists/oss-security/2024/04/24/3
- https://security.netapp.com/advisory/ntap-20230703-0006/
- https://www.openwall.com/lists/oss-security/2023/05/08/3
- http://www.openwall.com/lists/oss-security/2024/04/24/3
- https://security.netapp.com/advisory/ntap-20230703-0006/
- https://www.openwall.com/lists/oss-security/2023/05/08/3