CVE-2023-23454

Published on: Not Yet Published

Last Modified on: 03/03/2023 01:15:00 AM UTC

CVE-2023-23454

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Certain versions of Debian Linux from Debian contain the following vulnerability:

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).

CVE-2023-23454 has been assigned by [email protected] to track the vulnerability - currently rated as MEDIUM severity.

CVSS3 Score: 5.5 - MEDIUM

Attack Vector ^ⓘ	Attack Complexity	Privileges Required	User Interaction
LOCAL	LOW	LOW	NONE
Scope	Confidentiality Impact	Integrity Impact	Availability Impact
UNCHANGED	NONE	NONE	HIGH

CVE References

Description	Tags ^ⓘ	Link
[SECURITY] [DLA 3349-1] linux-5.10 security update	lists.debian.org text/html	MLIST [debian-lts-announce] 20230302 [SECURITY] [DLA 3349-1] linux-5.10 security update
kernel/git/torvalds/linux.git - Linux kernel source tree	git.kernel.org text/html	MISC git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=caa4b35b4317d5147b3ab0fbdc9c075c7d2e9c12
Debian -- Security Information -- DSA-5324-1 linux	www.debian.org Depreciated Link text/html	DEBIAN DSA-5324
oss-security - Re: Type Confusion in Linux Kernel	www.openwall.com text/html	MISC www.openwall.com/lists/oss-security/2023/01/10/4
oss-security - Type Confusion in Linux Kernel	www.openwall.com text/html	MISC www.openwall.com/lists/oss-security/2023/01/10/1

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

Related QID Numbers

160505 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2023-12196)
160515 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel-container (ELSA-2023-12207)
160516 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2023-12206)
181491 Debian Security Update for linux (DSA 5324-1)
181618 Debian Security Update for linux-5.10 (DLA 3349-1)
199208 Ubuntu Security Notification for Linux kernel (OEM) Vulnerabilities (USN-5915-1)
199212 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-5917-1)
199224 Ubuntu Security Notification for Linux kernel (Raspberry Pi) Vulnerabilities (USN-5934-1)
199226 Ubuntu Security Notification for Linux kernel (GCP) Vulnerabilities (USN-5939-1)
199230 Ubuntu Security Notification for Linux kernel (Raspberry Pi) Vulnerabilities (USN-5940-1)
199239 Ubuntu Security Notification for Linux kernel (IBM) Vulnerabilities (USN-5951-1)
354739 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.15-2023-013
354741 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.10-2023-026
354775 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.4-2023-042
672707 EulerOS Security Update for kernel (EulerOS-SA-2023-1444)
672747 EulerOS Security Update for kernel (EulerOS-SA-2023-1469)
672802 EulerOS Security Update for kernel (EulerOS-SA-2023-1551)
672806 EulerOS Security Update for kernel (EulerOS-SA-2023-1526)
753566 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:0145-1)
753583 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:0152-1)
753688 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:0406-1)
753689 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:0410-1)
753692 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:0407-1)
753709 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:0433-1)
753743 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:0618-1)
905254 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (13003)
905261 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (13006)
905288 Common Base Linux Mariner (CBL-Mariner) Security Update for hyperv-daemons (13049)
905407 Common Base Linux Mariner (CBL-Mariner) Security Update for hyperv-daemons (13049-1)
906024 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (13003-2)
906375 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (13006-2)

Known Affected Configurations (CPE V2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Debian	Debian Linux	11.0	All	All	All
Operating System	Linux	Linux Kernel	All	All	All	All

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*:
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*:

No vendor comments have been submitted for this CVE

Social Mentions

Source	Title	Posted (UTC)
@CVEreport	CVE-2023-23454 : cbq_classify in net/sched/sch_cbq.c in the #Linux #kernel through 6.1.4 allows attackers to cause… twitter.com/i/web/status/1…	2023-01-12 07:09:04
/r/googlecloudupdates	March 01, 2023 GCP release notes	2023-03-02 01:00:25
/r/googlecloudupdates	March 02, 2023 GCP release notes	2023-03-03 01:00:20