Buffer overflow in Linux kernel pstore

1) Buffer overflow

EUVDB-ID: #VU91437

Risk: Low

CVSSv3.1: 7.7 [AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52685

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to memory corruption within the persistent_ram_init_ecc() function in fs/pstore/ram_core.c. A local user can escalate privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

External links

http://git.kernel.org/stable/c/3b333cded94fbe5ce30d699b316c4715151268ae
http://git.kernel.org/stable/c/d1fe1aede684bd014714dacfdc75586a9ad38657
http://git.kernel.org/stable/c/acd413da3e1f37582207cd6078a41d57c9011918
http://git.kernel.org/stable/c/8fb12524c86bdd542a54857d5d076b1b6778c78c
http://git.kernel.org/stable/c/48dcfc42ce705b652c0619cb99846afc43029de9
http://git.kernel.org/stable/c/a34946ec3de88a16cc3a87fdab50aad06255a22b
http://git.kernel.org/stable/c/f9b891a7e8fcf83901f8507241e23e7420103b61
http://git.kernel.org/stable/c/86222a8fc16ec517de8da2604d904c9df3a08e5d

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.