CVE-2023-3772

Published: Jul 25, 2023Modified: Nov 21, 2024

4.4

Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Exploitability: 0.8 / Impact: 3.6

Source: NVD

Description

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.

Affected (8)

Products: Redhat: Enterprise Linux, Enterprise Linux For Real Time, Enterprise Linux For Real Time For Nfv · Fedoraproject: Fedora · Linux: Linux Kernel · +1 more

Show all products

Redhat: Enterprise Linux, Enterprise Linux For Real Time, Enterprise Linux For Real Time For Nfv · Fedoraproject: Fedora · Linux: Linux Kernel · Debian: Debian Linux

3 products

Enterprise Linux

Enterprise Linux For Real Time

Enterprise Linux For Real Time For Nfv

1 product

1 product

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0
Redhat Enterprise Linux For Real Time	Version 8.0
Redhat Enterprise Linux For Real Time For Nfv	Version 8.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	All versions

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	All versions

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 12.0

Related CWEs

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (19)

https://access.redhat.com/errata/RHSA-2023:6583

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2023:6901

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2023:7077

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:0412

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2024:0575

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2023-3772

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2218943

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

http://www.openwall.com/lists/oss-security/2023/08/10/1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2023/08/10/3

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2023:6583

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2023:6901

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2023:7077

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:0412

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2024:0575

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/security/cve/CVE-2023-3772

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2218943

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.debian.org/security/2023/dsa-5492

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.