First published: Wed May 31 2023(Updated: )
** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Linux Linux kernel | <6.3.3 | |
SUSE Linux Enterprise | =12.0-sp5 | |
SUSE Linux Enterprise | =15.0-sp4 | |
SUSE Linux Enterprise | =15.0-sp5 | |
Debian Debian Linux | =10.0 | |
debian/linux | 5.10.223-1 5.10.226-1 6.1.123-1 6.1.119-1 6.12.9-1 6.12.10-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID for this issue is CVE-2023-34256.
CVE-2023-34256 has a severity rating of 5.5 (medium).
Linux kernel versions before 6.3.3, Suse Linux Enterprise 12.0-sp5, Suse Linux Enterprise 15.0-sp4, and Suse Linux Enterprise 15.0-sp5 are affected by CVE-2023-34256.
The CWE-ID associated with CVE-2023-34256 is CWE-125.
Yes, you can find references for CVE-2023-34256 at the following links: [link1](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f04351888a83e595571de672e0a4a8b74f4fb31), [link2](https://syzkaller.appspot.com/bug?extid=8785e41224a3afd04321), [link3](https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.3)