CVE-2023-52501
published 2024-03-02CVE-2023-52501: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not attempt to read past "commit" When iterating over the ring buffer while…
PriorityP432high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.23%
14.0th percentile
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Do not attempt to read past "commit"
When iterating over the ring buffer while the ring buffer is active, the
writer can corrupt the reader. There's barriers to help detect this and
handle it, but that code missed the case where the last event was at the
very end of the page and has only 4 bytes left.
The checks to detect the corruption by the writer to reads needs to see the
length of the event. If the length in the first 4 bytes is zero then the
length is stored in the second 4 bytes. But if the writer is in the process
of updating that code, there's a small window where the length in the first
4 bytes could be zero even though the length is only 4 bytes. That will
cause rb_event_length() to read the next 4 bytes which could happen to be off the
allocated page.
To protect against this, fail immediately if the next event pointer is
less than 8 bytes from the end of the commit (last byte of data), as all
events must be a minimum of 8 bytes anyway.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.64-1 (bookworm) | linux 6.1.64-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 785888c544e0433f601df18ff98a3215b380b9c3 < cee5151c5410e868826b8afecfb356f3799ebea3 | cee5151c5410e868826b8afecfb356f3799ebea3 |
| linux | linux | >= 785888c544e0433f601df18ff98a3215b380b9c3 < 344f2f3e61a90f0150c754796ec9a17fcaeec03d | 344f2f3e61a90f0150c754796ec9a17fcaeec03d |
| linux | linux | >= 785888c544e0433f601df18ff98a3215b380b9c3 < b08a4938229dbb530a35c41b83002a1457c6ff49 | b08a4938229dbb530a35c41b83002a1457c6ff49 |
| linux | linux | >= 785888c544e0433f601df18ff98a3215b380b9c3 < 75fc9e99b3a71006720ad1e029db11a4b5c32d4a | 75fc9e99b3a71006720ad1e029db11a4b5c32d4a |
| linux | linux | >= 785888c544e0433f601df18ff98a3215b380b9c3 < 95a404bd60af6c4d9d8db01ad14fe8957ece31ca | 95a404bd60af6c4d9d8db01ad14fe8957ece31ca |
| linux | linux_kernel | < 5.10.198 | 5.10.198 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.205-1 | 5.10.205-1 |
| linux | linux_kernel | >= 0 < 6.1.64-1 | 6.1.64-1 |
| linux | linux_kernel | >= 0 < 6.5.6-1 | 6.5.6-1 |
| linux | linux_kernel | >= 0 < 6.5.6-1 | 6.5.6-1 |
| linux | linux_kernel | >= 5.11 < 5.15.134 | 5.15.134 |
| linux | linux_kernel | 5.16 – 6.1.56 | — |
| linux | linux_kernel | 6.2 – 6.5.6 | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jfc7-9f46-xvqw: In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Do not attempt to read past "commit"
When iterating over the ring b
ghsa_unreviewed·2024-03-03
CVE-2023-52501 [HIGH] CWE-125 GHSA-jfc7-9f46-xvqw: In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Do not attempt to read past "commit"
When iterating over the ring b
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Do not attempt to read past "commit"
When iterating over the ring buffer while the ring buffer is active, the
writer can corrupt the reader. There's barriers to help detect this and
handle it, but that code missed the case where the last event was at the
very end of the page and has only 4 bytes left.
The checks to detect the corruption by the writer to reads needs to see the
length of the event. If the length in the first 4 bytes is zero then the
length is stored in the second 4 bytes. But if the writer is in the process
of updating that code, there's a small window where the length in the first
4 bytes could be zero even though the length is only 4 bytes. That will
cause rb_event_length() to read the next
OSV
CVE-2023-52501: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not attempt to read past "commit" When iterating over the ring buf
osv·2024-03-02·CVSS 7.1
CVE-2023-52501 [HIGH] CVE-2023-52501: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not attempt to read past "commit" When iterating over the ring buf
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not attempt to read past "commit" When iterating over the ring buffer while the ring buffer is active, the writer can corrupt the reader. There's barriers to help detect this and handle it, but that code missed the case where the last event was at the very end of the page and has only 4 bytes left. The checks to detect the corruption by the writer to reads needs to see the length of the event. If the length in the first 4 bytes is zero then the length is stored in the second 4 bytes. But if the writer is in the process of updating that code, there's a small window where the length in the first 4 bytes could be zero even though the length is only 4 bytes. That will cause rb_event_length() to read the next 4
Red Hat
kernel: ring-buffer: Do not attempt to read past "commit"
vendor_redhat·2024-03-02·CVSS 7.1
CVE-2023-52501 [HIGH] CWE-125 kernel: ring-buffer: Do not attempt to read past "commit"
kernel: ring-buffer: Do not attempt to read past "commit"
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Do not attempt to read past "commit"
When iterating over the ring buffer while the ring buffer is active, the
writer can corrupt the reader. There's barriers to help detect this and
handle it, but that code missed the case where the last event was at the
very end of the page and has only 4 bytes left.
The checks to detect the corruption by the writer to reads needs to see the
length of the event. If the length in the first 4 bytes is zero then the
length is stored in the second 4 bytes. But if the writer is in the process
of updating that code, there's a small window where the length in the first
4 bytes could be zero even though the length is only 4 b
Debian
CVE-2023-52501: linux - In the Linux kernel, the following vulnerability has been resolved: ring-buffer...
vendor_debian·2023·CVSS 7.1
CVE-2023-52501 [HIGH] CVE-2023-52501: linux - In the Linux kernel, the following vulnerability has been resolved: ring-buffer...
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not attempt to read past "commit" When iterating over the ring buffer while the ring buffer is active, the writer can corrupt the reader. There's barriers to help detect this and handle it, but that code missed the case where the last event was at the very end of the page and has only 4 bytes left. The checks to detect the corruption by the writer to reads needs to see the length of the event. If the length in the first 4 bytes is zero then the length is stored in the second 4 bytes. But if the writer is in the process of updating that code, there's a small window where the length in the first 4 bytes could be zero even though the length is only 4 bytes. That will cause rb_event_length() to read the next 4
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/344f2f3e61a90f0150c754796ec9a17fcaeec03dhttps://git.kernel.org/stable/c/75fc9e99b3a71006720ad1e029db11a4b5c32d4ahttps://git.kernel.org/stable/c/95a404bd60af6c4d9d8db01ad14fe8957ece31cahttps://git.kernel.org/stable/c/b08a4938229dbb530a35c41b83002a1457c6ff49https://git.kernel.org/stable/c/cee5151c5410e868826b8afecfb356f3799ebea3https://git.kernel.org/stable/c/344f2f3e61a90f0150c754796ec9a17fcaeec03dhttps://git.kernel.org/stable/c/75fc9e99b3a71006720ad1e029db11a4b5c32d4ahttps://git.kernel.org/stable/c/95a404bd60af6c4d9d8db01ad14fe8957ece31cahttps://git.kernel.org/stable/c/b08a4938229dbb530a35c41b83002a1457c6ff49https://git.kernel.org/stable/c/cee5151c5410e868826b8afecfb356f3799ebea3
2024-03-02
Published