Bug 2244720 (CVE-2023-45863) - CVE-2023-45863 kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write
Summary: CVE-2023-45863 kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-boun...
Keywords:
Status: NEW
Alias: CVE-2023-45863
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2244721
Blocks: 2244710
TreeView+ depends on / blocked
 
Reported: 2023-10-17 22:43 UTC by Robb Gatica
Modified: 2024-05-02 22:50 UTC (History)
46 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds memory write flaw was found in the load/unload module in the Linux kernel's kobject functionality, potentially triggering a race condition in the kobject_get_path function. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:2634 0 None None None 2024-05-01 01:22:06 UTC
Red Hat Product Errata RHBA-2024:2650 0 None None None 2024-05-02 00:14:54 UTC
Red Hat Product Errata RHBA-2024:2686 0 None None None 2024-05-02 22:50:01 UTC
Red Hat Product Errata RHSA-2024:2394 0 None None None 2024-04-30 10:14:08 UTC

Description Robb Gatica 2023-10-17 22:43:38 UTC 
CVE-2023-45863

--- 

An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3bb2a01caa813d3a1845d378bbe4169ef280d394
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.2.3
Comment 1 Robb Gatica 2023-10-17 22:43:59 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2244721]
Comment 2 Justin M. Forbes 2023-10-18 13:46:12 UTC 
This was fixed for Fedora with the 6.2.3 stable kernel updates
Comment 6 errata-xmlrpc 2024-04-30 10:14:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:2394 https://access.redhat.com/errata/RHSA-2024:2394
Note You need to log in before you can comment on or make changes to this bug.