CVE-2023-34256
Published on: Not Yet Published
Last Modified on: 07/27/2023 09:15:00 PM UTC
Certain versions of Linux Kernel from Linux contain the following vulnerability:
** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access.
- CVE-2023-34256 has been assigned by
[email protected] to track the vulnerability - currently rated as MEDIUM severity.
CVSS3 Score: 5.5 - MEDIUM
| Attack Vector ⓘ |
Attack Complexity |
Privileges Required |
User Interaction |
|---|---|---|---|
| LOCAL | LOW | LOW | NONE |
| Scope | Confidentiality Impact |
Integrity Impact |
Availability Impact |
| UNCHANGED | NONE | NONE | HIGH |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| cdn.kernel.org text/plain |
MISC cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.3 | |
| [SECURITY] [DLA 3508-1] linux security update | lists.debian.org text/html |
MLIST [debian-lts-announce] 20230727 [SECURITY] [DLA 3508-1] linux security update |
| KASAN: slab-out-of-bounds Read in ext4_group_desc_csum | syzkaller.appspot.com text/html |
MISC syzkaller.appspot.com/bug?extid=8785e41224a3afd04321 |
| 1211895 – (CVE-2023-34256) VUL-0: CVE-2023-34256: kernel: potential slab-out-of-bounds in ext4_group_desc_csum | bugzilla.suse.com text/html |
MISC bugzilla.suse.com/show_bug.cgi?id=1211895 |
| kernel/git/torvalds/linux.git - Linux kernel source tree | git.kernel.org text/html |
MISC git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f04351888a83e595571de672e0a4a8b74f4fb31 |
Related QID Numbers
- 160766 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2023-12566)
- 160767 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2023-12565)
- 355531 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.10-2023-034
- 355532 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.15-2023-021
- 355536 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.4-2023-047
- 355545 Amazon Linux Security Advisory for kernel : ALAS2-2023-2100
- 355557 Amazon Linux Security Advisory for kernel : ALAS-2023-1773
- 390285 Oracle Managed Virtualization (VM) Server for x86 Security Update for kernel (OVMSA-2023-0017)
- 390286 Oracle Managed Virtualization (VM) Server for x86 Security Update for kernel (OVMSA-2023-0018)
- 673261 EulerOS Security Update for kernel (EulerOS-SA-2023-2614)
- 673272 EulerOS Security Update for kernel (EulerOS-SA-2023-2584)
- 907004 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (27052-1)
- 907022 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (27063-1)
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Linux | Linux Kernel | All | All | All | All |
| Operating System | Suse | Linux Enterprise | 12.0 | sp5 | All | All |
| Operating System | Suse | Linux Enterprise | 15.0 | sp4 | All | All |
| Operating System | Suse | Linux Enterprise | 15.0 | sp5 | All | All |
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise:12.0:sp5:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise:15.0:sp4:*:*:*:*:*:*:
- cpe:2.3:o:suse:linux_enterprise:15.0:sp5:*:*:*:*:*:*:
No vendor comments have been submitted for this CVE