huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-28487: sudo: Sudo does not escape control characters in sudoreplay output
Component: sudo
Severity: Moderate
CWE: CWE-117 (Improper Output Neutralization for Logs)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2023-03-16T00:00:00+00:00

A flaw was found in the sudo package, shipped with Red Hat Enterprise Linux 8 and 9, where the "sudoreplay -l' command improperly escapes terminal control characters. As sudo's log messages may contain user-controlled strings, this could allow an attacker to inject terminal control commands, leading to a leak of restricted information.


Affected upstream versions: n/a
Fixed upstream versions: v1.9.13
Upstream repository: https://github.com/sudo-project/sudo
Upstream fix commit: 334daf92b31b79ce68ed75e2ee14fca265f029ca
CVE-2023-28617: emacs: command injection vulnerability in org-mode
Component: emacs
Severity: Important
CWE: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2023-03-19T00:00:00+00:00

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the function org-babel-execute:latex in ob-latex.el can result in arbitrary command execution.


Affected upstream versions: n/a
Upstream repository: https://git.savannah.gnu.org/cgit/emacs/org-mode.git
Upstream fix commit: 8f8ec2ccf3f5ef8f38d68ec84a7e4739c45db485
CVE-2023-28625: mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is supplied
Component: mod_auth_openidc
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-04-03T00:00:00+00:00

A flaw was found in mod_auth_openidc, an OpenID Certified™ authentication and authorization module for the Apache HTTP server. It is possible to trigger a NULL pointer dereference when `OIDCStripCookies` is set and a crafted `Cookie` header is supplied, leading to a segmentation fault and a denial of service.


Affected upstream versions: >= 2.0.0, < 2.4.13.2
Fixed upstream versions: v2.4.13.2
Upstream repository: https://github.com/OpenIDC/mod_auth_openidc
Upstream fix commit: c0e1edac3c4c19988ccdc7713d7aebfce6ff916a
CVE-2023-28772: kernel: lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-03-23T00:00:00+00:00

A buffer overflow write flaw was identified in seq_buf_putmem_hex in lib/seq_buf.c in seq_buf in the Linux Kernel. This issue may allow a user with special debug privileges such as ftrace or root to cause an overflow in the destination buffer due to a missing sanity check.


Affected upstream versions: n/a
Fixed upstream versions: v5.14
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: d3b16034a24a112bb83aeb669ac5b9b01f744bb7
CVE-2023-28856: redis: Insufficient validation of HINCRBYFLOAT command
Component: redis
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-04-17T00:00:00+00:00

A vulnerability was found in Redis. This flaw allows authenticated users to use the HINCRBYFLOAT command to create an invalid hash field that may crash Redis on access.


Affected upstream versions: >= 7.0.0, < 7.0.11, >= 6.2.0, < 6.2.12, < 6.0.19
Fixed upstream versions: 7.2.0
Upstream repository: https://github.com/redis/redis
Upstream fix commit: bc7fe41e5857a0854d524e2a63a028e9394d2a5c
CVE-2023-28866: kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2023-03-27T00:00:00+00:00

An out-of-bounds (OOB) memory access flaw was found in net/bluetooth/hci_sync.c due to a missing exit patch while in loop in amp_init1[] and amp_init2[]. This issue could allow an attacker to leak internal kernel information.


Affected upstream versions: n/a
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git
Upstream fix commit: 95084403f8c070ccf5d7cbe72352519c1798a40a
CVE-2023-28879: ghostscript: buffer overflow in base/sbcp.c leading to data corruption
Component: ghostscript
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-03-31T00:00:00+00:00

In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interpreter, in base/sbcp.c. This affects BCPEncode, BCPDecode, TBCPEncode, and TBCPDecode. If the write buffer is filled to one byte less than full, and one then tries to write an escaped character, two bytes are written.


Affected upstream versions: n/a
Fixed upstream versions: ghostpdl-10.01.1-gse-10174
Upstream repository: https://git.ghostscript.com/ghostpdl.git
Upstream fix commit: 37ed5022cecd584de868933b5b60da2e995b3179
CVE-2023-29007: git: arbitrary configuration injection when renaming or deleting a section from a configuration file
Component: git
Severity: Important
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2023-04-25T00:00:00+00:00

A vulnerability was found in Git. This security flaw occurs when renaming or deleting a section from a configuration file, where certain malicious configuration values may be misinterpreted as the beginning of a new configuration section. This flaw leads to arbitrary configuration injection.


Affected upstream versions: < 2.30.9, >= 2.31.0, < 2.31.8, >= 2.32.0, < 2.32.7, >= 2.33.0, < 2.33.8, >= 2.34.0, < 2.34.8, >= 2.35.0, < 2.35.8, >= 2.36.0, < 2.36.6, >= 2.37.0, < 2.37.7, >= 2.38.0, < 2.38.5, >= 2.39.0, < 2.39.3, >= 2.40.0, < 2.40.1
Fixed upstream versions: v2.30.9
Upstream repository: https://github.com/git/git
Upstream fix commit: 528290f8c61222433a8cf02fb7cfffa8438432b4
CVE-2023-29491: ncurses: Local users can trigger security-relevant memory corruption via malformed data
Component: ncurses
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-04-12T00:00:00+00:00

A vulnerability was found in ncurses and occurs when used by a setuid application. This flaw allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable.

Statement: The impact of this CVE is rated Moderate for several reasons which make it difficult to exploit or limited consequences:
* The only outcome is memory corruption possibly leading to a crash
* There is no trace of privilege escalation
* It cannot be triggered remotely, an attacker must have local access

Affected upstream versions: n/a
Upstream repository: https://ncurses.scripts.mit.edu/ncurses.git
Upstream fix commit: eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56
CVE-2023-2975: openssl: AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries
Component: openssl
Severity: Low
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2023-07-07T00:00:00+00:00

A vulnerability was found in OpenSSL. The AES-SIV cipher implementation contains a bug that causes it to ignore empty associated data entries, which are unauthenticated as a consequence. Applications that use the AES-SIV algorithm and want to authenticate empty data entries as associated data can be misled by removing, adding, or reordering such empty entries as these are ignored by the OpenSSL implementation. The AES-SIV algorithm allows for the authentication of multiple associated data entries and encryption. To authenticate empty data, the application has to call EVP_EncryptUpdate() (or EVP_CipherUpdate()) with a NULL pointer as the output buffer and 0 as the input buffer length. The AES-SIV implementation in OpenSSL returns success for such a call instead of performing the associated data authentication operation. Thus, the empty data will not be authenticated.

Statement: This issue does not affect Red Hat Enterprise Linux 6, 7, and 8 as the vulnerable OpenSSL package is currently not shipped. As this issue does not affect non-empty associated data authentication and we expect it to be rare for an application to use empty associated data entries, this is rated with a Low severity.

Affected upstream versions: 3.1.0 < 3.1.2, 3.0.0 < 3.0.10
Fixed upstream versions: 3.0.10, 3.1.2
Upstream repository: https://git.openssl.org/gitweb/openssl.git
Upstream fix commit: 6a83f0c958811f07e0d11dfc6b5a6a98edfd5bdc
CVE-2023-3006: RHEL: Add Spectre-BHB mitigation for AmpereOne
Component: RHEL
Severity: Moderate
CWE: CWE-226 (Sensitive Information in Resource Not Removed Before Reuse)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2022-11-07T00:00:00+00:00

A known cache speculation vulnerability, the Branch History Injection (BHI) or Spectre-BHB, was found in new hw (that are cores Cortex: A57, A72, A76, A77, A78, A78AE, A78C, A710, X1, X2; Neoverse: N1, N2, V1; Ampere1). Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to information disclosure.

Statement: The current known mechanisms to exploit this issue rely on unprivileged eBPF functionality. Unprivileged eBPF is disabled by default on Red Hat Enterprise Linux.

Affected upstream versions: Linux Kernel 6.1-rc1
Fixed upstream versions: v6.1
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
Upstream fix commit: 0e5d5ae837c8
CVE-2023-3022: kernel: IPv6: panic in fib6_rule_suppress when fib6_rule_lookup fails
Component: kernel
Severity: Moderate
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2019-04-24T00:00:00+00:00

A flaw was found in the IPv6 module of the Linux kernel. The arg.result was not used consistently in fib6_rule_lookup, sometimes holding rt6_info and other times fib6_info. This was not accounted for in other parts of the code where rt6_info was expected unconditionally, potentially leading to a kernel panic in fib6_rule_suppress.


Affected upstream versions: Fixed in kernel 5.2-rc1
Fixed upstream versions: v5.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: a65120bae4b7
CVE-2023-30456: kernel: KVM: nVMX: missing consistency checks for CR0 and CR4
Component: kernel
Severity: Moderate
CWE: CWE-358 (Improperly Implemented Security Check for Standard)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Public date: 2023-04-10T00:00:00+00:00

A flaw was found in the KVM's Intel nested virtualization feature (nVMX). The effective values of the guest CR0 and CR4 registers could differ from those included in the VMCS12. In rare circumstances (i.e., kvm_intel module loaded with parameters nested=1 and ept=0) this could allow a malicious guest to crash the host system, causing a denial of service.

Statement: Red Hat currently provides the nested virtualization feature as a Technology Preview. Nested virtualization is therefore unsupported for production use. For more information please refer to https://access.redhat.com/solutions/21101 and https://access.redhat.com/support/offerings/techpreview.

Affected upstream versions: n/a
Fixed upstream versions: v6.3
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 112e66017bff7f2837030f34c2bc19501e9212d5
CVE-2023-30551: rekor: compressed archives can result in OOM conditions
Component: rekor
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-05-09T00:00:00+00:00

A flaw was found in Rekor. Versions prior to 1.1.1 may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing an APK file submitted to Rekor can also cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. The OOM crash has been patched in Rekor version 1.1.1. There are no known workarounds.


Affected upstream versions: < 1.1.1
Fixed upstream versions: v1.1.1
Upstream repository: https://github.com/sigstore/rekor
Upstream fix commit: cf42ace82667025fe128f7a50cf6b4cdff51cc48
CVE-2023-30608: sqlparse: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service)
Component: sqlparse
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-04-19T00:00:00+00:00

A flaw was found in sqlparse. The SQL parser contains a regular expression vulnerable to a Regular Expression Denial of Service (ReDoS). The vulnerability may lead to a denial of service (DoS).


Affected upstream versions: >= 0.1.15, < 0.4.4
Fixed upstream versions: 0.4.4
Upstream repository: https://github.com/andialbrecht/sqlparse
Upstream fix commit: c457abd5f097dd13fb21543381e7cfafe7d31cfb
CVE-2023-30630: dmidecode: dump-bin to overwrite a local file
Component: dmidecode
Severity: Moderate
CWE: CWE-269 (Improper Privilege Management)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2023-04-13T00:00:00+00:00

A vulnerability was found in dmidecode, which allows -dump-bin to overwrite a local file. This issue may lead to the execution of dmidecode via Sudo.

Statement: The impact of the CVE marked as moderate as this CVE relies on an improbable non-default configuration of allowing an unprivileged user to run demidecode under sudo with a specific insecure configuration in the sudoers file. Using dmidecode in such a manner is no different than allowing any other tool to unexpectedly run with elevated privileges.

Affected upstream versions: n/a
Upstream repository: https://git.savannah.nongnu.org/cgit/dmidecode.git
Upstream fix commit: d8cfbc808f387e87091c25e7d5b8c2bb348bb206
CVE-2023-30861: flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header
Component: flask
Severity: Important
CWE: CWE-488 (Exposure of Data Element to Wrong Session)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2023-05-05T00:00:00+00:00

A flaw was found in the Python Flask package. A cached response may contain data for one client sent by a proxy to other clients, including session cookies, resulting in the compromise of data confidentiality contained in the leak requests or cookies. This happens when the following conditions are met by the proxy's behavior regarding cookies and the application's behavior session usage:
1. The caching proxy does not strip or ignore response with cookies
2. The application sets a permanent session
3. The application does not access or modify the session during requests
4. SESSION_REFRESH_EACH_REQUEST is enabled, which is the default Flask behavior
5. The application does not set the Cache-Control header to avoid being cached


Affected upstream versions: >= 2.3.0, < 2.3.2, < 2.2.5
Fixed upstream versions: 2.3.x
Upstream repository: https://github.com/pallets/flask
Upstream fix commit: 70f906c51ce49c485f1d355703e9cc3386b1cc2b
CVE-2023-3090: kernel: ipvlan: out-of-bounds write caused by unclear skb->cb
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-05-10T00:00:00+00:00

A flaw was found in the IPVLAN network driver in the Linux kernel. This issue is caused by missing skb->cb initialization in `__ip_options_echo` and can lead to an out-of-bounds write stack overflow. This may allow a local user to cause a denial of service or potentially achieve local privilege escalation.

Statement: Red Hat Enterprise Linux 6 and 7 are not affected by this flaw as they did not include IPVLAN support.

Affected upstream versions: 3.19 < 6.4
Fixed upstream versions: 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 90cbed5247439a966b645b34eb0a2e037836ea8e
CVE-2023-31083: kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl
Component: kernel
Severity: Moderate
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-04-17T00:00:00+00:00

A NULL pointer dereference flaw was found in the Linux kernel’s Bluetooth HCI UART driver. This flaw allows a local user to crash the system.


Affected upstream versions: n/a
Fixed upstream versions: v6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/bluetooth/hci_ldisc.c
Upstream fix commit: 9c33663af9ad115f90c076a1828129a3fbadea98
CVE-2023-31084: kernel: blocking operation in dvb_frontend_get_event and wait_event_interruptible
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-04-17T00:00:00+00:00

A potential deadlock flaw was found in the Linux’s kernel DVB API (used by Digital TV devices) functionality. This flaw allows a local user to crash the system.


Affected upstream versions: n/a
Fixed upstream versions: v6.4
Upstream repository: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git
Upstream fix commit: b8c75e4a1b325ea0a9433fa8834be97b5836b946
CVE-2023-3138: libX11: InitExt.c can overwrite unintended portions of the Display structure if the extension request leads to a buffer overflow
Component: libX11
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H)
Public date: 2023-06-15T00:00:00+00:00

A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.

Statement: The identified security vulnerability in the libX11 library, categorized with a moderate impact, stems from a lack of bounds checking in certain functions within the library's InitExt.c file. Specifically, these functions do not verify that the values provided for Request, Event, or Error IDs fall within the bounds specified by the X11 protocol. Consequently, if a malicious X server or intermediary manipulates these values, it can trigger memory corruption within the client's Display structure. While this can lead to crashes or instability within the client application, the impact is constrained within the client's memory space and does not directly compromise sensitive data or system resources beyond it. The vulnerability requires specific conditions, such as interaction with a malicious server or intermediary, which limits its practical exploitability.

Affected upstream versions: libX11 1.8.6
Fixed upstream versions: libX11-1.8.6
Upstream repository: https://gitlab.freedesktop.org/xorg/lib/libx11
Upstream fix commit: 304a654a0d57bf0f00d8998185f0360332cfa36c
CVE-2023-3141: kernel: Use after free bug in r592_remove
Component: kernel
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-03-07T06:30:00+00:00

A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This issue may allow a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak.

Statement: Because this flaw requires that specific peripheral hardware is attached, that an attacker has access to the hardware, and that the attacker is able to control the timing of hardware or media attachment and removal, Red Hat assesses the impact of this vulnerability as Low.

Affected upstream versions: Kenrel version prior to Kernel 6.4-rc1
Fixed upstream versions: v6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 63264422785021704c39b38f65a78ab9e4a186d7
CVE-2023-31436: kernel: out-of-bounds write in qfq_change_class function
Component: kernel
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-04-13T00:00:00+00:00

An out-of-bounds memory access flaw was found in the Linux kernel’s traffic control (QoS) subsystem in how a user triggers the qfq_change_class function with an incorrect MTU value of the network device used as lmax. This flaw allows a local user to crash or potentially escalate their privileges on the system.


Affected upstream versions: n/a
Fixed upstream versions: v6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: 3037933448f60f9acb705997eae62013ecb81e0d
CVE-2023-3153: ovn: service monitor MAC flow is not rate limited
Component: ovn
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2023-06-07T00:00:00+00:00

A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured.


Affected upstream versions: <= v23.03.0
Fixed upstream versions: 22.03.3, 22.09.2, 22.12.1, 23.03.1, 23.06.1
Upstream repository: https://github.com/ovn-org/ovn
Upstream fix commit: 9a3f7ed905e525ebdcb14541e775211cbb0203bd
CVE-2023-3161: kernel: fbcon: shift-out-of-bounds in fbcon_set_font()
Component: kernel
Severity: Moderate
CWE: CWE-1335 (Incorrect Bitwise Shift of Integer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-01-25T00:00:00+00:00

A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing a font->width and font->height greater than 32 to the fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs, leading to undefined behavior and possible denial of service.


Affected upstream versions: Fixed in kernel 6.2-rc7
Fixed upstream versions: v6.2
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 2b09d5d364986f724f17001ccfe4126b9b43a0be