CVE-2023-1078: High severity linux kernel vulnerability
A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rdsrmzerocopycallback() uses listentry() on the head of a list causing a type confusion. Local user can trigger this with rdsmessageput(). Type confusion leads to struct rdsmsgzcopyinfo info actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an out of bounds access, and a lock corruption.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1078?
CVE-2023-1078 is considered a high severity vulnerability due to its potential for local exploitation.
How do I fix CVE-2023-1078?
To fix CVE-2023-1078, upgrade your Linux Kernel to a version that is patched, such as 5.10.223-1 or later.
Who is affected by CVE-2023-1078?
CVE-2023-1078 affects local users running vulnerable versions of the Linux Kernel that utilize the RDS protocol.
What components are involved in CVE-2023-1078?
CVE-2023-1078 involves a flaw in the RDS (Reliable Datagram Sockets) protocol within the Linux Kernel.
What could happen if CVE-2023-1078 is exploited?
Exploitation of CVE-2023-1078 could lead to type confusion vulnerabilities affecting memory management and data integrity.