#VU90347 Out-of-bounds read in Linux kernel - CVE-2023-52504

Vulnerability identifier: #VU90347

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52504

CWE-ID: CWE-125

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to an out-of-bounds read error within the apply_alternatives() function in arch/x86/kernel/alternative.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/3719d3c36aa853d5a2401af9f8d6b116c91ad5ae
https://git.kernel.org/stable/c/3770c38cd6a60494da29ac2da73ff8156440a2d1
https://git.kernel.org/stable/c/6788b10620ca6e98575d1e06e72a8974aad7657e
https://git.kernel.org/stable/c/ecba5afe86f30605eb9dfb7f265a8de0218d4cfc
https://git.kernel.org/stable/c/5b784489c8158518bf7a466bb3cc045b0fb66b4b
https://git.kernel.org/stable/c/cd287cc208dfe6bd6da98e7f88e723209242c9b4
https://git.kernel.org/stable/c/d35652a5fc9944784f6f50a5c979518ff8dacf61

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.