← Back

CVE-2023-0459

nvd nist
Published: May 25, 2023Modified: Jun 17, 2026

JSON object

Loading...
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 3.6
Source: NVD

Description

Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47

Affected (7)

Products: Linux: Linux Kernel
Linux
1 product
Linux Kernel
Configuration A
7 vulnerable
Vulnerable SoftwareAffected Versions
Linux
Linux Kernel
Before 4.14.307
Linux Kernel
From 4.19.0 to 4.19.274
Linux Kernel
From 5.10.0 to 5.10.170
Linux Kernel
From 5.15.0 to 5.15.96
Linux Kernel
From 5.4.0 to 5.4.233
Linux Kernel
From 6.1.0 to 6.1.14
Linux Kernel
From 6.2.0 to 6.2.1

Related CWEs

CWE-763
Release of Invalid Pointer or Reference
The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.

References (4)

Source: cve-coordination@google.com
Patch
Source: cve-coordination@google.com
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
Patch

Timeline

No history available yet.