CyberSecBulletin
CVE-2023-52434NVD status: Modified

Linux: Improper Restriction of Operations within the Bounds of a Memory Buffer

Published Updated By the CyberSecBulletin desk

CVE-2023-52434 is a high-severity improper restriction of operations within the bounds of a memory buffer vulnerability in Linux, with a CVSS 3.1 base score of 8.0 out of 10. It can be exploited from the same local network by an attacker with a low-privileged account, without any action from a user. The record lists versions 6726429c18c62dbf5e96ebbd522f262e016553fb, 13fb0fc4917621f3dfa285a27eaf7151d770b5e5, 890bc4fac3c0973a49cac35f634579bebba7fe48 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 1.02% chance of exploitation within 30 days, higher than 64% of scored CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 6726429c18c62dbf5e96ebbd522f262e016553fb or 13fb0fc4917621f3dfa285a27eaf7151d770b5e5 or 890bc4fac3c0973a49cac35f634579bebba7fe48 or 1ae3c59355dc9882e09c020afe8ffbd895ad0f29, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.4.277 or 5.10.211 or 5.15.150 or 6.6.8, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxb8c32dbb0deb287a5fcb78251e4eae6c7275760d up to, but not including, 6726429c18c62dbf5e96ebbd522f262e016553fb; b8c32dbb0deb287a5fcb78251e4eae6c7275760d up to, but not including, 13fb0fc4917621f3dfa285a27eaf7151d770b5e5; b8c32dbb0deb287a5fcb78251e4eae6c7275760d up to, but not including, 890bc4fac3c0973a49cac35f634579bebba7fe48; b8c32dbb0deb287a5fcb78251e4eae6c7275760d up to, but not including, 1ae3c59355dc9882e09c020afe8ffbd895ad0f29; b8c32dbb0deb287a5fcb78251e4eae6c7275760d up to, but not including, 17a0f64cc02d4972e21c733d9f21d1c512963afa; b8c32dbb0deb287a5fcb78251e4eae6c7275760d up to, but not including, af1689a9b7701d9907dfc84d2a4b57c4bc907144; 3.76726429c18c62dbf5e96ebbd522f262e016553fb, 13fb0fc4917621f3dfa285a27eaf7151d770b5e5, 890bc4fac3c0973a49cac35f634579bebba7fe48, 1ae3c59355dc9882e09c020afe8ffbd895ad0f29, 17a0f64cc02d4972e21c733d9f21d1c512963afa, af1689a9b7701d9907dfc84d2a4b57c4bc907144
LinuxLinux Kernel5.3 up to, but not including, 5.4.277; 5.5 up to, but not including, 5.10.211; 5.11 up to, but not including, 5.15.150; 5.16 through 6.1.79; 6.2 up to, but not including, 6.6.8; 6.75.4.277, 5.10.211, 5.15.150, 6.6.8
DebianDebian Linux10.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.18.1HighCNA
CVSS 3.18.0HighNVD

Official description

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing invalid create contexts from server: BUG: unable to handle page fault for address: ffff8881178d8cc3 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 4a01067 P4D 4a01067 PUD 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 1736 Comm: mount.cifs Not tainted 6.7.0-rc4 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:smb2_parse_contexts+0xa0/0x3a0 [cifs] Code: f8 10 75 13 48 b8 93 ad 25 50 9c b4 11 e7 49 39 06 0f 84 d2 00 00 00 8b 45 00 85 c0 74 61 41 29 c5 48 01 c5 41 83 fd 0f 76 55 <0f> b7 7d 04 0f b7 45 06 4c 8d 74 3d 00 66 83 f8 04 75 bc ba 04 00 RSP: 0018:ffffc900007939e0 EFLAGS: 00010216 RAX: ffffc90000793c78 RBX: ffff8880180cc000 RCX: ffffc90000793c90 RDX: ffffc90000793cc0 RSI: ffff8880178d8cc0 RDI: ffff8880180cc000 RBP: ffff8881178d8cbf R08: ffffc90000793c22 R09: 0000000000000000 R10: ffff8880180cc000 R11: 0000000000000024 R12: 0000000000000000 R13: 0000000000000020 R14: 0000000000000000 R15: ffffc90000793c22 FS: 00007f873753cbc0(0000) GS:ffff88806bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8881178d8cc3 CR3: 00000000181ca000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> ? __die+0x23/0x70 ? page_fault_oops+0x181/0x480 ? search_module_extables+0x19/0x60 ? srso_alias_return_thunk+0x5/0xfbef5 ? exc_page_fault+0x1b6/0x1c0 ? asm_exc_page_fault+0x26/0x30 ? smb2_parse_contexts+0xa0/0x3a0 [cifs] SMB2_open+0x38d/0x5f0 [cifs] ? smb2_is_path_accessible+0x138/0x260 [cifs] smb2_is_path_accessible+0x138/0x260 [cifs] cifs_is_path_remote+0x8d/0x230 [cifs] cifs_mount+0x7e/0x350 [cifs] cifs_smb3_do_mount+0x128/0x780 [cifs] smb3_get_tree+0xd9/0x290 [cifs] vfs_get_tree+0x2c/0x100 ? capable+0x37/0x70 path_mount+0x2d7/0xb80 ? srso_alias_return_thunk+0x5/0xfbef5 ? _raw_spin_unlock_irqrestore+0x44/0x60 __x64_sys_mount+0x11a/0x150 do_syscall_64+0x47/0xf0 entry_SYSCALL_64_after_hwframe+0x6f/0x77 RIP: 0033:0x7f8737657b1e

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.

How developers prevent this class of flaw

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega, and the Strsafe.h library from Microsoft. These libraries provide safer versions of overflow-prone string-handling functions.
  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.

More Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerabilities (CWE-119)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerabilities

Spotted an error? Tell us.