CVE-2023-42752: Kernel: integer overflow in igmpv3_newpack leading to exploitable memory access
An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating skbsharedinfo in the userspace, which is exploitable in systems without SMAP protection since skbsharedinfo contains references to function pointers.
Other sources
Integer overflow in the Linux kernel, which leads to the kernel allocating skbsharedinfo in the userspace, which is exploitable in systems without SMAP protection since skbsharedinfo contains references to function pointers.
Refer: https://seclists.org/oss-sec/2023/q3/192
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 6.6
Event History
Frequently Asked Questions
What is the severity of CVE-2023-42752?
CVE-2023-42752 is rated as a high-severity vulnerability due to the potential for exploitation leading to critical system compromise.
How do I fix CVE-2023-42752?
To resolve CVE-2023-42752, upgrade to the recommended kernel versions, including 6.6 for Red Hat or apply the specific patches listed in your distribution's advisory.
What systems are affected by CVE-2023-42752?
CVE-2023-42752 affects Linux Kernel versions up to 6.5.7 and notable Red Hat and Debian kernel versions listed in their security alerts.
Can CVE-2023-42752 be exploited without SMAP protection?
Yes, CVE-2023-42752 can be exploited in systems without SMAP protection, leading to potential user space issues.
What type of flaw is CVE-2023-42752?
CVE-2023-42752 is an integer overflow flaw that results in inadequate kernel memory management, allowing for possible code execution attacks.