Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup()

Summary

CVE	CVE-2023-4459
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2023-08-21 19:15:09 UTC
Updated	2026-10-08 21:17:49 UTC
Description	A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup.

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.002490000 probability, percentile 0.149530000 (date 2026-10-10)

Problem Types: CWE-476 | CWE-476 NULL Pointer Dereference

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Primary	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
3.1	[email protected]	Secondary	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`
3.1	CNA	CVSS	5.5	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

CVSS v3.1 Breakdown

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Linux	Linux Kernel	All	All	All	All
Operating System	Redhat	Enterprise Linux	8.0	All	All	All
Operating System	Redhat	Enterprise Linux	9.0	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	unaffected 0:4.18.0-193.133.1.el8_2 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	unaffected 0:4.18.0-193.133.1.rt13.184.el8_2 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	unaffected 0:4.18.0-193.133.1.el8_2 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8.2 Update Services For SAP Solutions	unaffected 0:4.18.0-193.133.1.el8_2 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	unaffected 0:4.18.0-305.125.1.el8_4 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	unaffected 0:4.18.0-305.125.1.rt7.201.el8_4 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	unaffected 0:4.18.0-305.125.1.el8_4 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8.4 Update Services For SAP Solutions	unaffected 0:4.18.0-305.125.1.el8_4 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	unaffected 0:4.18.0-372.87.1.el8_6 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	unaffected 0:5.14.0-70.93.2.el9_0 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	unaffected 0:5.14.0-70.93.1.rt21.165.el9_0 * rpm	Not specified
CNA	Red Hat	Red Hat Virtualization 4 For Red Hat Enterprise Linux 8	unaffected 0:4.18.0-372.87.1.el8_6 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 6	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 7	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 7	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 9	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 9	Not specified	Not specified

References

Reference	Source	Link	Tags
net: vmxnet3: fix possible NULL pointer dereference in vmxnet3_rq_cle… · torvalds/linux@edf410c · GitHub	af854a3a-2127-422b-91ae-364da2661108	github.com	Patch
access.redhat.com/errata/RHSA-2024:2008	af854a3a-2127-422b-91ae-364da2661108	access.redhat.com
access.redhat.com/errata/RHSA-2024:2006	af854a3a-2127-422b-91ae-364da2661108	access.redhat.com
access.redhat.com/errata/RHSA-2024:1250	af854a3a-2127-422b-91ae-364da2661108	access.redhat.com
access.redhat.com/errata/RHSA-2024:1306	af854a3a-2127-422b-91ae-364da2661108	access.redhat.com
Red Hat	af854a3a-2127-422b-91ae-364da2661108	access.redhat.com
access.redhat.com/errata/RHSA-2024:1367	af854a3a-2127-422b-91ae-364da2661108	access.redhat.com
access.redhat.com/errata/RHSA-2024:1382	af854a3a-2127-422b-91ae-364da2661108	access.redhat.com
2219268 – (CVE-2023-4459) CVE-2023-4459 kernel: vmxnet3: NULL pointer dereference in vmxnet3_rq_cleanup()	af854a3a-2127-422b-91ae-364da2661108	bugzilla.redhat.com	Issue Tracking, Patch
cve-details	af854a3a-2127-422b-91ae-364da2661108	access.redhat.com	Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Additional Advisory Data

Source	Time	Event
CNA	2023-06-28T00:00:00.000Z	Reported to Red Hat.
CNA	2022-05-14T00:00:00.000Z	Made public.

Workarounds

CNA: In order to mitigate this issue, prevent the affected code from being loaded by blacklisting the kernel module "vmxnet3". For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278 ~~~ Exploiting this flaw will require CAP_NET_ADMIN access privilege in any user or network namespace. ~~~

Legacy QID Mappings

160949 Oracle Enterprise Linux Security Update for unbreakable enterprise kernel (ELSA-2023-12842)
199765 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6388-1)
242855 Red Hat Update for kernel (RHSA-2024:0412)
243050 Red Hat Update for kernel (RHSA-2024:1250)
243062 Red Hat Update for kernel-rt (RHSA-2024:1306)
243076 Red Hat Update for kernel (RHSA-2024:1367)
243096 Red Hat Update for kernel-rt (RHSA-2024:1382)
390290 Oracle Managed Virtualization (VM) Server for x86 Security Update for kernel (OVMSA-2023-0023)
673449 EulerOS Security Update for kernel (EulerOS-SA-2023-2898)
673484 EulerOS Security Update for kernel (EulerOS-SA-2023-3033)
673563 EulerOS Security Update for kernel (EulerOS-SA-2024-1144)
673732 EulerOS Security Update for kernel (EulerOS-SA-2023-3010)
673848 EulerOS Security Update for kernel (EulerOS-SA-2023-3217)
673970 EulerOS Security Update for kernel (EulerOS-SA-2023-2879)
754832 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3600-1)
754833 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3599-1)
754855 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3656-1)
754863 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3680-1)
754866 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3684-1)
754867 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3683-1)
754868 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3682-1)
754869 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3681-1)
754876 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3687-1)
754883 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3705-1)
754884 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3704-1)
754899 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3599-2)
754900 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3600-2)
754901 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3704-2)
754903 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3683-2)
755026 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3964-1)
755037 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3971-1)
755038 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3969-1)
755043 SUSE Enterprise Linux Security Update for the Linux Kernel (SUSE-SU-2023:3988-1)