CVE-2023-2008: Linux Kernel udmabuf Improper Validation of Array Index Local Privilege Escalation Vulnerability
A flaw was found in the Linux kernel's udmabuf device driver, within a fault handler. This issue occurs due to the lack of proper validation of user-supplied data, which can result in memory access past the end of an array. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.
Other sources
A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
A flaw was found in udmabuf. udmabuf is a linux device driver for user space mappable DMA buffer. Quoting ZDI security advisory [1]:
"This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel."
[1] https://www.zerodayinitiative.com/advisories/ZDI-23-441/
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.19
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2023-2008.
What is the severity rating of CVE-2023-2008?
CVE-2023-2008 has a severity rating of 8.2 (high).
What software is affected by CVE-2023-2008?
Linux Kernel versions up to and including 5.19 are affected by CVE-2023-2008.
How can an attacker exploit CVE-2023-2008?
An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit CVE-2023-2008.
Where can I find more information about CVE-2023-2008?
You can find more information about CVE-2023-2008 on the following references: [Reference 1](https://github.com/torvalds/linux/commit/05b252cccb2e5c3f56119d25de684b4f810ba4), [Reference 2](https://www.zerodayinitiative.com/advisories/ZDI-23-441/), [Reference 3](https://access.redhat.com/errata/RHSA-2022:8267).