Linux: Out-of-bounds Read
CVE-2023-52598 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 6ccf904aac0292e1f6b1a1be6c407c414f7cf713, 6d0822f2cc9b153bf2df49a84599195a2e0d21a8, 856caf2730ea18cb39e95833719c02a02447dc0a as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to 6ccf904aac0292e1f6b1a1be6c407c414f7cf713 or 6d0822f2cc9b153bf2df49a84599195a2e0d21a8 or 856caf2730ea18cb39e95833719c02a02447dc0a or 28a1f492cb527f64593457a0a0f0d809b3f36c25, whichever matches your release line, or a later version.
- Update Linux Kernel to 4.19.307 or 5.4.269 or 5.10.210 or 5.15.149, whichever matches your release line, or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 9977e886cbbc758b4b601a160b5825ba573b5ca8 up to, but not including, 6ccf904aac0292e1f6b1a1be6c407c414f7cf713; 9977e886cbbc758b4b601a160b5825ba573b5ca8 up to, but not including, 6d0822f2cc9b153bf2df49a84599195a2e0d21a8; 9977e886cbbc758b4b601a160b5825ba573b5ca8 up to, but not including, 856caf2730ea18cb39e95833719c02a02447dc0a; 9977e886cbbc758b4b601a160b5825ba573b5ca8 up to, but not including, 28a1f492cb527f64593457a0a0f0d809b3f36c25; 9977e886cbbc758b4b601a160b5825ba573b5ca8 up to, but not including, 7a4d6481fbdd661f9e40e95febb95e3dee82bad3; 9977e886cbbc758b4b601a160b5825ba573b5ca8 up to, but not including, 02c6bbfb08bad78dd014e24c7b893723c15ec7a1; 9977e886cbbc758b4b601a160b5825ba573b5ca8 up to, but not including, bdce67df7f12fb0409fbc604ce7c4254703f56d4; 9977e886cbbc758b4b601a160b5825ba573b5ca8 up to, but not including, 8b13601d19c541158a6e18b278c00ba69ae37829; and 1 more ranges | 6ccf904aac0292e1f6b1a1be6c407c414f7cf713, 6d0822f2cc9b153bf2df49a84599195a2e0d21a8, 856caf2730ea18cb39e95833719c02a02447dc0a, 28a1f492cb527f64593457a0a0f0d809b3f36c25, 7a4d6481fbdd661f9e40e95febb95e3dee82bad3, 02c6bbfb08bad78dd014e24c7b893723c15ec7a1 |
| Linux | Linux Kernel | before 4.19.307; 4.20 up to, but not including, 5.4.269; 5.5 up to, but not including, 5.10.210; 5.11 up to, but not including, 5.15.149; 5.16 up to, but not including, 6.1.77; 6.2 up to, but not including, 6.6.16; 6.7 up to, but not including, 6.7.4 | 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.77, 6.6.16 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.
Official description
In the Linux kernel, the following vulnerability has been resolved: s390/ptrace: handle setting of fpc register correctly If the content of the floating point control (fpc) register of a traced process is modified with the ptrace interface the new value is tested for validity by temporarily loading it into the fpc register. This may lead to corruption of the fpc register of the tracing process: if an interrupt happens while the value is temporarily loaded into the fpc register, and within interrupt context floating point or vector registers are used, the current fp/vx registers are saved with save_fpu_regs() assuming they belong to user space and will be loaded into fp/vx registers when returning to user space. test_fp_ctl() restores the original user space fpc register value, however it will be discarded, when returning to user space. In result the tracer will incorrectly continue to run with the value that was supposed to be used for the traced process. Fix this by saving fpu register contents with save_fpu_regs() before using test_fp_ctl().
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
How developers prevent this class of flaw
- Use a language that provides appropriate memory abstractions.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/02c6bbfb08bad78dd014e24c7b893723c15ec7a1Mailing List
- git.kernel.org/stable/c/28a1f492cb527f64593457a0a0f0d809b3f36c25Mailing List
- git.kernel.org/stable/c/6ccf904aac0292e1f6b1a1be6c407c414f7cf713Mailing List
- git.kernel.org/stable/c/6d0822f2cc9b153bf2df49a84599195a2e0d21a8Mailing List
- git.kernel.org/stable/c/7a4d6481fbdd661f9e40e95febb95e3dee82bad3Mailing List
- git.kernel.org/stable/c/856caf2730ea18cb39e95833719c02a02447dc0aMailing List
- git.kernel.org/stable/c/8b13601d19c541158a6e18b278c00ba69ae37829Mailing List
- git.kernel.org/stable/c/bdce67df7f12fb0409fbc604ce7c4254703f56d4Mailing List
- lists.debian.org/debian-lts-announce/2024/06/msg00017.htmlMailing List
Recent Out-of-bounds Read vulnerabilities
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
- 7.1 High severity
Spotted an error? Tell us.