CVE-2023-6560: Kernel: io_uring out of boundary memory access in __io_uaddr_map()
A flaw in the Linux Kernel found. For the iouring SQ/CQ rings, out of boundaries memory access could happen as result of incorrect behavior in function iouaddrmap for the case of not physically contiguous memory.
Reference: https://patchwork.kernel.org/project/io-uring/patch/20231130194633.649319-2-axboe@kernel.dk/
Other sources
An out-of-bounds memory access flaw was found in the iouring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-6560?
CVE-2023-6560 is a vulnerability in the Linux kernel's io_uring SQ/CQ rings functionality, which allows a local user to trigger an out-of-bounds memory access.
How severe is CVE-2023-6560?
CVE-2023-6560 has a severity rating of medium with a CVSS score of 5.5.
How can a local user exploit CVE-2023-6560?
A local user can exploit CVE-2023-6560 by triggering an out-of-bounds memory access in the io_uring SQ/CQ rings functionality.
Which versions of the Linux kernel are affected by CVE-2023-6560?
Versions up to exclusive 6.7 of the Red Hat kernel are affected by CVE-2023-6560.
Is there a fix available for CVE-2023-6560?
Yes, a fix for CVE-2023-6560 is available. Please refer to the references for more information.