CVE-2023-39197 — Out-of-bounds Read in Kernel

CWE-125 — Out-of-bounds ReadCWE-20 — Improper Input ValidationCWE-79 — Cross-site Scripting20 documents9 sources
Severity
7.5HIGHNVD
CNA4.0OSV6.8OSV6.4CISA6.1
EPSS
0.0%
top 88.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Linux KernelFedoraproject Fedora
Timeline
PublishedJan 23
Latest updateApr 9

Description

An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDlinux/linux_kernel2.6.26 — 5.4.251+5
▶Debianlinux/linux_kernel< 5.10.191-1+3
▶Ubuntulinux/linux_kernel< 4.4.0-252.286+1

Also affects: Fedora 38

🔴Vulnerability Details

9
OSV
linux-azure vulnerabilities↗2024-04-09
▶
OSV
linux-aws-hwe, linux-azure, linux-azure-4.15, linux-oracle vulnerabilities↗2024-03-25
▶
OSV
linux-aws vulnerabilities↗2024-03-21
▶
OSV
linux-gcp, linux-gcp-4.15 vulnerabilities↗2024-03-20
▶
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities↗2024-03-18
▶

📋Vendor Advisories

9
Ubuntu
Linux kernel (Azure) vulnerabilities↗2024-04-09
▶
Ubuntu
Linux kernel vulnerabilities↗2024-03-25
▶
Ubuntu
Linux kernel (AWS) vulnerabilities↗2024-03-21
▶
Ubuntu
Linux kernel (GCP) vulnerabilities↗2024-03-20
▶
Ubuntu
Linux kernel vulnerabilities↗2024-03-18
▶

💬Community

1
Bugzilla
CVE-2023-39197 kernel: DCCP: conntrack out-of-bounds read in nf_conntrack_dccp_packet()↗2023-06-28
▶