CVE-2023-4016 — Heap-based Buffer Overflow in Project Procps

CWE-122 — Heap-based Buffer OverflowCWE-787 — Out-of-bounds Write8 documents8 sources
Severity
3.3LOWNVD
CNA2.5
EPSS
0.0%
top 97.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Procps Project ProcpsLinux KernalFedoraproject Fedora
Timeline
PublishedAug 2
Latest updateApr 15

Description

Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 1.8 | Impact: 1.4

Affected Packages3 packages

▶Debianprocps_project/procps< 2:4.0.4-1+1
▶NVDprocps_project/procps3.3.0 — 4.0.3
▶CVEListV5linux/linux_kernal3.3.0 (might be earlier) - latest

Also affects: Fedora 38

🔴Vulnerability Details

3
OSV
CVE-2023-4016: Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amoun↗2023-08-02
▶
GHSA
GHSA-v76x-qfmc-m88p: Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amoun↗2023-08-02
▶
CVEList
CVE-2023-4016: Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amoun↗2023-08-02
▶

📋Vendor Advisories

4
Oracle
Oracle Oracle Communications Risk Matrix: Install/Upgrade (procps) — CVE-2023-4016↗2024-04-15
▶
Ubuntu
procps-ng vulnerability↗2023-11-14
▶
Red Hat
procps: ps buffer overflow↗2023-08-02
▶
Debian
CVE-2023-4016: procps - Under some circumstances, this weakness allows a user who has access to run the ...↗2023
▶
CVE-2023-4016 — Heap-based Buffer Overflow | cvebase