CVE-2023-3772: Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()

Published Jun 30, 2023
·
Updated

========== 1. Null-ptr-deref in xfrmupdateaeparams() ==========

[require privilege]: CAPNETADMIN

[effects]: local DoS

[crash stack]: [ 47.933119] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 47.933119] #PF: supervisor write access in kernel mode [ 47.933119] #PF: errorcode(0x0002) - not-present page [ 47.933119] PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0 [ 47.933119] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI [ 47.933119] CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8 [ 47.933119] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4 [ 47.933119] RIP: 0010:memcpyorig+0xad/0x140 [ 47.933119] Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c [ 47.933119] RSP: 0018:ffff888008f57658 EFLAGS: 00000202 [ 47.933119] RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571 [ 47.933119] RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 [ 47.933119] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 47.933119] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818 [ 47.933119] R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 [ 47.933119] FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 [ 47.933119] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 47.933119] CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 [ 47.933119] Call Trace: [ 47.933119] <TASK> [ 47.933119] ? die+0x1f/0x70 [ 47.933119] ? pagefaultoops+0x1e8/0x500 [ 47.933119] ? pfxisprefetch.constprop.0+0x10/0x10 [ 47.933119] ? pfxpagefaultoops+0x10/0x10 [ 47.933119] ? rawspinunlockirqrestore+0x11/0x40 [ 47.933119] ? fixupexception+0x36/0x460 [ 47.933119] ? rawspinunlockirqrestore+0x11/0x40 [ 47.933119] ? excpagefault+0x5e/0xc0 [ 47.933119] ? asmexcpagefault+0x26/0x30 [ 47.933119] ? xfrmupdateaeparams+0xd1/0x260 [ 47.933119] ? memcpyorig+0xad/0x140 [ 47.933119] ? pfxrawspinlockbh+0x10/0x10 [ 47.933119] xfrmupdateaeparams+0xe7/0x260 [ 47.933119] xfrmnewae+0x298/0x4e0 [ 47.933119] ? pfxxfrmnewae+0x10/0x10 [ 47.933119] xfrmuserrcvmsg+0x25a/0x410 [ 47.933119] ? pfxxfrmuserrcvmsg+0x10/0x10 [ 47.933119] ? allocskb+0xcf/0x210 [ 47.933119] ? stacktracesave+0x90/0xd0 [ 47.933119] ? filterirqstacks+0x1c/0x70 [ 47.933119] ? stackdepotsave+0x39/0x4e0 [ 47.933119] ? kasanslabfree+0x10a/0x190 [ 47.933119] ? kmemcachefree+0x9c/0x340 [ 47.933119] ? netlinkrecvmsg+0x23c/0x660 [ 47.933119] ? sockrecvmsg+0xeb/0xf0 [ 47.933119] ? sysrecvfrom+0x13c/0x1f0 [ 47.933119] ? x64sysrecvfrom+0x71/0x90 [ 47.933119] ? dosyscall64+0x3f/0x90 [ 47.933119] ? entrySYSCALL64afterhwframe+0x72/0xdc [ 47.933119] ? copyout+0x3e/0x50 [ 47.933119] netlinkrcvskb+0xd6/0x210 [ 47.933119] ? pfxxfrmuserrcvmsg+0x10/0x10 [ 47.933119] ? pfxnetlinkrcvskb+0x10/0x10 [ 47.933119] ? pfxsockhasperm+0x10/0x10 [ 47.933119] ? mutexlock+0x8d/0xe0 [ 47.933119] ? pfxmutexlock+0x10/0x10 [ 47.933119] xfrmnetlinkrcv+0x44/0x50 [ 47.933119] netlinkunicast+0x36f/0x4c0 [ 47.933119] ? pfxnetlinkunicast+0x10/0x10 [ 47.933119] ? netlinkrecvmsg+0x500/0x660 [ 47.933119] netlinksendmsg+0x3b7/0x700 [ 47.933119] ? pfxnetlinksendmsg+0x10/0x10 [ 47.933119] ? updateloadavg+0x591/0xab0 [ 47.933119] ? pfxnetlinksendmsg+0x10/0x10 [ 47.933119] socksendmsg+0xde/0xe0 [ 47.933119] syssendto+0x18d/0x230 [ 47.933119] ? pfxsyssendto+0x10/0x10 [ 47.933119] ? rbinsertcolor+0x1c0/0x280 [ 47.933119] ? timerqueueadd+0x128/0x150 [ 47.933119] ? ktimeget+0x49/0xb0 [ 47.933119] ? pfxnativeapicmemwrite+0x10/0x10 [ 47.933119] ? lapicnextevent+0x35/0x40 [ 47.933119] ? clockeventsprogramevent+0xdf/0x140 [ 47.933119] ? hrtimerinterrupt+0x321/0x360 [ 47.933119] x64syssendto+0x71/0x90 [ 47.933119] dosyscall64+0x3f/0x90 [ 47.933119] entrySYSCALL64afterhwframe+0x72/0xdc [ 47.933119] RIP: 0033:0x44b8aa [ 47.933119] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 9 [ 47.933119] RSP: 002b:00007fff7ded8258 EFLAGS: 00000246 ORIGRAX: 000000000000002c [ 47.933119] RAX: ffffffffffffffda RBX: 00007fff7ded9688 RCX: 000000000044b8aa [ 47.933119] RDX: 00000000000002a8 RSI: 00007fff7ded8480 RDI: 0000000000000003 [ 47.933119] RBP: 00007fff7ded82c0 R08: 00007fff7ded829c R09: 000000000000000c [ 47.933119] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 47.933119] R13: 00007fff7ded9678 R14: 00000000004c37d0 R15: 0000000000000001 [ 47.933119] </TASK> [ 47.933119] Modules linked in: [ 47.933119] CR2: 0000000000000000 [ 47.933119] ---[ end trace 0000000000000000 ]--- [ 47.933119] RIP: 0010:memcpyorig+0xad/0x140 [ 47.933119] Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c [ 47.933119] RSP: 0018:ffff888008f57658 EFLAGS: 00000202 [ 47.933119] RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571 [ 47.933119] RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 [ 47.933119] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 47.933119] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818 [ 47.933119] R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 [ 47.933119] FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 [ 47.933119] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 47.933119] CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 [ 47.933119] Kernel panic - not syncing: Fatal exception in interrupt [ 47.933119] Kernel Offset: disabled [ 47.933119] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---

[buggy commit]: d8647b79c3b7 ("xfrm: Add user interface for esn and big anti-replay windows")

[root cause]: x->replayesn and x->preplayesn should be allocated at xfrmallocreplaystateesn(...) in xfrmstateconstruct(..), and then the xfrmupdateaeparams(...) is okay to update them. However, the current implementation allows a malicious user to directly dereference the pointer and crash the kernel like above.

[PoC code]: see attachment poc1.c. I have tested it in ubuntu 22.04 and latest Linux with QEMU.

[suggest fix]: Add NULL check in xfrmupdateaeparams() like below:

@@ -628,7 +628,7 @@ static void xfrmupdateaeparams(struct xfrmstate x, struct nlattr attrs, struct nlattr rt = attrs[XFRMAREPLAYTHRESH]; struct nlattr mt = attrs[XFRMAMTIMERTHRESH];

- if (re) { + if (re && x->replayesn && x->preplayesn) { struct xfrmreplaystateesn replayesn;

Other sources

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAPNETADMIN privileges to directly dereference a NULL pointer in xfrmupdateaeparams(), leading to a possible kernel crash and denial of service.

— Ubuntu

Kernel: xfrm: null pointer dereference in xfrmupdateaeparams()

— Microsoft

Linux Kernel is vulnerable to a denial of service, caused by a NULL pointer dereference flaw in the xfrmupdateaeparams() function in the IP framework for transforming packets (XFRM subsystem). By sending a specially crafted request, a local authenticated attacker could exploit this vulnerability to cause the kernel to crash.

— IBM

Affected Software

166 affected componentsFixes available
redhat Enterprise Linux=8.0
redhat Enterprise Linux=9.0
Fedoraproject Fedora
Linux Linux kernel
IBM Security Verify Governance, Identity Manager software component<=ISVG 10.0.2
IBM Security Verify Governance, Identity Manager virtual appliance component<=ISVG 10.0.2
Microsoft cbl2 hyperv-daemons 5.15.153.1-1
Patch available
Microsoft cbl2 hyperv-daemons 5.15.158.1-1
Patch available
Microsoft cbl2 hyperv-daemons 5.15.153.1-1
Patch available
redhat Enterprise Linux For Real Time=8.0
redhat Enterprise Linux For Real Time For Nfv=8.0
Debian Debian Linux=10.0
Debian Debian Linux=12.0
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1
ubuntu/linux-aws<4.4.0-1124.130
4.4.0-1124.130
ubuntu/linux-azure<4.15.0-1171.186~14.04.1
4.15.0-1171.186~14.04.1
ubuntu/linux-lts-xenial<4.4.0-246.280~14.04.1
4.4.0-246.280~14.04.1
ubuntu/linux*
ubuntu/linux<4.4.0-246.280
4.4.0-246.280
ubuntu/linux-aws<4.4.0-1162.177
4.4.0-1162.177
ubuntu/linux-aws-hwe<4.15.0-1162.175~16.04.1
4.15.0-1162.175~16.04.1
ubuntu/linux-azure<4.15.0-1171.186~16.04.1
4.15.0-1171.186~16.04.1
ubuntu/linux-gcp<4.15.0-1156.173~16.04.1
4.15.0-1156.173~16.04.1
ubuntu/linux-hwe<4.15.0-219.230~16.04.1
4.15.0-219.230~16.04.1
ubuntu/linux-kvm<4.4.0-1125.135
4.4.0-1125.135
ubuntu/linux-oracle<4.15.0-1125.136~16.04.1
4.15.0-1125.136~16.04.1
ubuntu/linux-hwe-edge*
ubuntu/linux-fips<4.4.0-1094.101
4.4.0-1094.101
ubuntu/linux-fips*
ubuntu/linux<4.15.0-219.230
4.15.0-219.230
ubuntu/linux-aws<4.15.0-1162.175
4.15.0-1162.175
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-aws-5.4<5.4.0-1113.123~18.04.1
5.4.0-1113.123~18.04.1
ubuntu/linux-azure*
ubuntu/linux-azure-4.15<4.15.0-1171.186
4.15.0-1171.186
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-5.4<5.4.0-1119.126~18.04.2
5.4.0-1119.126~18.04.2
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-4.15<4.15.0-1156.173
4.15.0-1156.173
ubuntu/linux-gcp-5.3*
ubuntu/linux-gcp-5.4<5.4.0-1117.126~18.04.1
5.4.0-1117.126~18.04.1
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-5.4<5.4.0-166.183~18.04.2
5.4.0-166.183~18.04.2
ubuntu/linux-hwe-edge*
ubuntu/linux-ibm-5.4<5.4.0-1060.65~18.04.1
5.4.0-1060.65~18.04.1
ubuntu/linux-kvm<4.15.0-1146.151
4.15.0-1146.151
ubuntu/linux-oem*
ubuntu/linux-oracle<4.15.0-1125.136
4.15.0-1125.136
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-oracle-5.4<5.4.0-1112.121~18.04.4
5.4.0-1112.121~18.04.4
ubuntu/linux-raspi-5.4<5.4.0-1097.109~18.04.2
5.4.0-1097.109~18.04.2
ubuntu/linux-aws-fips<4.15.0-2101.107
4.15.0-2101.107
ubuntu/linux-azure-fips<4.15.0-2080.86
4.15.0-2080.86
ubuntu/linux-fips<4.15.0-1117.128
4.15.0-1117.128
ubuntu/linux-gcp-fips<4.15.0-2064.69
4.15.0-2064.69
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.4.0-166.183
5.4.0-166.183
ubuntu/linux-aws<5.4.0-1113.123
5.4.0-1113.123
ubuntu/linux-aws-5.15<5.15.0-1049.54~20.04.1
5.15.0-1049.54~20.04.1
ubuntu/linux-azure<5.4.0-1119.126
5.4.0-1119.126
ubuntu/linux-azure-5.15<5.15.0-1051.59~20.04.1
5.15.0-1051.59~20.04.1
ubuntu/linux-bluefield<5.4.0-1074.80
5.4.0-1074.80
ubuntu/linux-gcp<5.4.0-1117.126
5.4.0-1117.126
ubuntu/linux-gcp-5.15<5.15.0-1046.54~20.04.1
5.15.0-1046.54~20.04.1
ubuntu/linux-gkeop<5.4.0-1080.84
5.4.0-1080.84
ubuntu/linux-gkeop-5.15<5.15.0-1032.38~20.04.1
5.15.0-1032.38~20.04.1
ubuntu/linux-hwe-5.15<5.15.0-88.98~20.04.1
5.15.0-88.98~20.04.1
ubuntu/linux-ibm<5.4.0-1060.65
5.4.0-1060.65
ubuntu/linux-ibm-5.15<5.15.0-1042.45~20.04.1
5.15.0-1042.45~20.04.1
ubuntu/linux-intel-iotg-5.15<5.15.0-1045.51~20.04.1
5.15.0-1045.51~20.04.1
ubuntu/linux-iot<5.4.0-1025.26
5.4.0-1025.26
ubuntu/linux-kvm<5.4.0-1102.108
5.4.0-1102.108
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-88.98~20.04.1
5.15.0-88.98~20.04.1
ubuntu/linux-nvidia-tegra-5.15<5.15.0-1019.19~20.04.1
5.15.0-1019.19~20.04.1
ubuntu/linux-oracle<5.4.0-1112.121
5.4.0-1112.121
ubuntu/linux-oracle-5.15<5.15.0-1047.53~20.04.1
5.15.0-1047.53~20.04.1
ubuntu/linux-raspi<5.4.0-1097.109
5.4.0-1097.109
ubuntu/linux-riscv-5.15<5.15.0-1045.49~20.04.1
5.15.0-1045.49~20.04.1
ubuntu/linux-xilinx-zynqmp<5.4.0-1033.37
5.4.0-1033.37
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-aws-fips<5.4.0-1113.123+fips1
5.4.0-1113.123+fips1
ubuntu/linux-azure-fips<5.4.0-1119.126+fips1
5.4.0-1119.126+fips1
ubuntu/linux-fips<5.4.0-1088.97
5.4.0-1088.97
ubuntu/linux-gcp-fips<5.4.0-1117.126+fips1
5.4.0-1117.126+fips1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.15.0-88.98
5.15.0-88.98
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1049.54
5.15.0-1049.54
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2<6.2.0-1015.15~22.04.1
6.2.0-1015.15~22.04.1
ubuntu/linux-azure<5.15.0-1051.59
5.15.0-1051.59
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2<6.2.0-1016.16~22.04.1
6.2.0-1016.16~22.04.1
ubuntu/linux-azure-fde<5.15.0-1051.59.1
5.15.0-1051.59.1
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2<6.2.0-1016.16~22.04.1.1
6.2.0-1016.16~22.04.1.1
ubuntu/linux-gcp<5.15.0-1046.54
5.15.0-1046.54
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2<6.2.0-1018.20~22.04.1
6.2.0-1018.20~22.04.1
ubuntu/linux-gke<5.15.0-1046.51
5.15.0-1046.51
ubuntu/linux-gkeop<5.15.0-1032.38
5.15.0-1032.38
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2<6.2.0-36.37~22.04.1
6.2.0-36.37~22.04.1
ubuntu/linux-ibm<5.15.0-1042.45
5.15.0-1042.45
ubuntu/linux-intel-iotg<5.15.0-1045.51
5.15.0-1045.51
ubuntu/linux-kvm<5.15.0-1046.51
5.15.0-1046.51
ubuntu/linux-lowlatency<5.15.0-88.98
5.15.0-88.98
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2<6.2.0-1016.16~22.04.1
6.2.0-1016.16~22.04.1
ubuntu/linux-nvidia<5.15.0-1040.40
5.15.0-1040.40
ubuntu/linux-nvidia-6.2<6.2.0-1011.11
6.2.0-1011.11
ubuntu/linux-nvidia-tegra<5.15.0-1019.19
5.15.0-1019.19
ubuntu/linux-nvidia-tegra-igx<5.15.0-1006.6
5.15.0-1006.6
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1<6.1.0-1023.23
6.1.0-1023.23
ubuntu/linux-oracle<5.15.0-1047.53
5.15.0-1047.53
ubuntu/linux-raspi<5.15.0-1042.45
5.15.0-1042.45
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2<6.2.0-1009.10~22.04.1
6.2.0-1009.10~22.04.1
ubuntu/linux-xilinx-zynqmp<5.15.0-1025.29
5.15.0-1025.29
ubuntu/linux-bluefield<5.15.0-1031.33
5.15.0-1031.33
ubuntu/linux-intel-iot-realtime<5.15.0-1042.44
5.15.0-1042.44
ubuntu/linux-realtime<5.15.0-1050.56
5.15.0-1050.56
ubuntu/linux-fips*
ubuntu/linux-raspi-realtime*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
  2. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1124.130
  3. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1171.186~14.04.1
  4. Upgrade

    Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.

    Fixed in 4.4.0-246.280~14.04.1
  5. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.4.0-246.280
  6. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.4.0-1162.177
  7. Upgrade

    Upgrade ubuntu/linux-aws-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-1162.175~16.04.1
  8. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 4.15.0-1171.186~16.04.1
  9. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 4.15.0-1156.173~16.04.1
  10. Upgrade

    Upgrade ubuntu/linux-hwe to a version that resolves this vulnerability.

    Fixed in 4.15.0-219.230~16.04.1
  11. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.4.0-1125.135
  12. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1125.136~16.04.1
  13. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.4.0-1094.101
  14. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 4.15.0-219.230
  15. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 4.15.0-1162.175
  16. Upgrade

    Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1113.123~18.04.1
  17. Upgrade

    Upgrade ubuntu/linux-azure-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1171.186
  18. Upgrade

    Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1119.126~18.04.2
  19. Upgrade

    Upgrade ubuntu/linux-gcp-4.15 to a version that resolves this vulnerability.

    Fixed in 4.15.0-1156.173
  20. Upgrade

    Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1117.126~18.04.1
  21. Upgrade

    Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-166.183~18.04.2
  22. Upgrade

    Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1060.65~18.04.1
  23. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 4.15.0-1146.151
  24. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 4.15.0-1125.136
  25. Upgrade

    Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1112.121~18.04.4
  26. Upgrade

    Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1097.109~18.04.2
  27. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2101.107
  28. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2080.86
  29. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-1117.128
  30. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 4.15.0-2064.69
  31. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-166.183
  32. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1113.123
  33. Upgrade

    Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1049.54~20.04.1
  34. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1119.126
  35. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1051.59~20.04.1
  36. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.4.0-1074.80
  37. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1117.126
  38. Upgrade

    Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1046.54~20.04.1
  39. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.4.0-1080.84
  40. Upgrade

    Upgrade ubuntu/linux-gkeop-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1032.38~20.04.1
  41. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-88.98~20.04.1
  42. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1060.65
  43. Upgrade

    Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1042.45~20.04.1
  44. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1045.51~20.04.1
  45. Upgrade

    Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.

    Fixed in 5.4.0-1025.26
  46. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1102.108
  47. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-88.98~20.04.1
  48. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1019.19~20.04.1
  49. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1112.121
  50. Upgrade

    Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1047.53~20.04.1
  51. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1097.109
  52. Upgrade

    Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1045.49~20.04.1
  53. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1033.37
  54. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1113.123+fips1
  55. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1119.126+fips1
  56. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1088.97
  57. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1117.126+fips1
  58. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-88.98
  59. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1049.54
  60. Upgrade

    Upgrade ubuntu/linux-aws-6.2 to a version that resolves this vulnerability.

    Fixed in 6.2.0-1015.15~22.04.1
  61. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1051.59
  62. Upgrade

    Upgrade ubuntu/linux-azure-6.2 to a version that resolves this vulnerability.

    Fixed in 6.2.0-1016.16~22.04.1
  63. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 5.15.0-1051.59.1
  64. Upgrade

    Upgrade ubuntu/linux-azure-fde-6.2 to a version that resolves this vulnerability.

    Fixed in 6.2.0-1016.16~22.04.1.1
  65. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1046.54
  66. Upgrade

    Upgrade ubuntu/linux-gcp-6.2 to a version that resolves this vulnerability.

    Fixed in 6.2.0-1018.20~22.04.1
  67. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1046.51
  68. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 5.15.0-1032.38
  69. Upgrade

    Upgrade ubuntu/linux-hwe-6.2 to a version that resolves this vulnerability.

    Fixed in 6.2.0-36.37~22.04.1
  70. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1042.45
  71. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1045.51
  72. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1046.51
  73. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-88.98
  74. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-6.2 to a version that resolves this vulnerability.

    Fixed in 6.2.0-1016.16~22.04.1
  75. Upgrade

    Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.

    Fixed in 5.15.0-1040.40
  76. Upgrade

    Upgrade ubuntu/linux-nvidia-6.2 to a version that resolves this vulnerability.

    Fixed in 6.2.0-1011.11
  77. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 5.15.0-1019.19
  78. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.

    Fixed in 5.15.0-1006.6
  79. Upgrade

    Upgrade ubuntu/linux-oem-6.1 to a version that resolves this vulnerability.

    Fixed in 6.1.0-1023.23
  80. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1047.53
  81. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1042.45
  82. Upgrade

    Upgrade ubuntu/linux-starfive-6.2 to a version that resolves this vulnerability.

    Fixed in 6.2.0-1009.10~22.04.1
  83. Upgrade

    Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1025.29
  84. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.15.0-1031.33
  85. Upgrade

    Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1042.44
  86. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1050.56
  87. Configuration

    Disable unprivileged user namespaces temporarily with `sudo sysctl -w kernel.unprivileged_userns_clone=0`; persist the setting across reboots in `/etc/sysctl.d/99-disable-unpriv-userns.conf`.

    Linux kernel kernel.unprivileged_userns_clone = 0

Event History

Jun 30, 2023
Data Sourced
via Red Hat·04:44 PM
DescriptionSeverityAffected Software
Jul 25, 2023
CVE Published
via Ubuntu·12:00 AM
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
CVE Published
via MITRE·03:47 PM
Data Sourced
via MITRE·03:47 PM
DescriptionSeverityWeakness
Data Sourced
via OSV·04:15 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Jan 21, 2024
Data Sourced
via Microsoft·08:00 AM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is the severity of CVE-2023-3772?

CVE-2023-3772 has a severity level indicating that it can cause a local denial of service (DoS) due to a null pointer dereference.

2

How do I fix CVE-2023-3772?

To fix CVE-2023-3772, ensure your system is updated to the latest patched version of the Linux kernel or the affected software components.

3

Which systems are affected by CVE-2023-3772?

CVE-2023-3772 affects IBM Security Verify Governance, the Linux kernel, and specific versions of Red Hat Enterprise Linux, Debian, and Fedora.

4

What are the potential impacts of CVE-2023-3772?

The potential impact of CVE-2023-3772 is a crash of the system due to a null pointer dereference, leading to system instability.

5

Who is responsible for addressing CVE-2023-3772?

It is the responsibility of system administrators and organizations using affected software to monitor and apply available updates to mitigate CVE-2023-3772.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203