CVE-2023-52596 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: sysctl: Fix out of bounds access for empty sysctl registers When registering tables to the sysctl subsystem there is a check to see if header is a permanently empty directory (used for mounts). This check evaluates the first element of the ctl_table. This results in an out of bounds evaluation when registering empty directories. The function register_sysctl_mount_point now passes a ctl_table of size 1 instead of size 0. It now relies solely on the type to identify a permanently empty register. Make sure that the ctl_table has at least one element before testing for permanent emptiness.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/15893975e9e382f8294ea8d926f08dc2d8d39ede
https://git.kernel.org/stable/c/2ae7081bc10123b187e36a4f3a8e53768de31489
https://git.kernel.org/stable/c/315552310c7de92baea4e570967066569937a843
https://lore.kernel.org/linux-cve-announce/2024030645-CVE-2023-52596-b98e@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2023-52596
https://www.cve.org/CVERecord?id=CVE-2023-52596

History

Mon, 04 Nov 2024 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 17 Sep 2024 19:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-03-06T06:45:26.094Z

Updated: 2024-11-04T14:49:24.137Z

Reserved: 2024-03-02T21:55:42.571Z

Link: CVE-2023-52596

Vulnrichment

Updated: 2024-08-02T23:03:21.269Z

NVD

Status : Awaiting Analysis

Published: 2024-03-06T07:15:09.657

Modified: 2024-03-06T15:18:08.093

Link: CVE-2023-52596

Redhat

Severity : Moderate

Publid Date: 2024-03-06T00:00:00Z

Links: CVE-2023-52596 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-52596", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-02T21:55:42.571Z", "datePublished": "2024-03-06T06:45:26.094Z", "dateUpdated": "2024-11-04T14:49:24.137Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T14:49:24.137Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsysctl: Fix out of bounds access for empty sysctl registers\n\nWhen registering tables to the sysctl subsystem there is a check to see\nif header is a permanently empty directory (used for mounts). This check\nevaluates the first element of the ctl_table. This results in an out of\nbounds evaluation when registering empty directories.\n\nThe function register_sysctl_mount_point now passes a ctl_table of size\n1 instead of size 0. It now relies solely on the type to identify\na permanently empty register.\n\nMake sure that the ctl_table has at least one element before testing for\npermanent emptiness."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/proc/proc_sysctl.c"], "versions": [{"version": "1da177e4c3f4", "lessThan": "15893975e9e3", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "2ae7081bc101", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f4", "lessThan": "315552310c7d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/proc/proc_sysctl.c"], "versions": [{"version": "6.6.16", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.4", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/15893975e9e382f8294ea8d926f08dc2d8d39ede"}, {"url": "https://git.kernel.org/stable/c/2ae7081bc10123b187e36a4f3a8e53768de31489"}, {"url": "https://git.kernel.org/stable/c/315552310c7de92baea4e570967066569937a843"}], "title": "sysctl: Fix out of bounds access for empty sysctl registers", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52596", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-06T15:39:37.053752Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:22:38.702Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:21.269Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/15893975e9e382f8294ea8d926f08dc2d8d39ede", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2ae7081bc10123b187e36a4f3a8e53768de31489", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/315552310c7de92baea4e570967066569937a843", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/15893975e9e382f8294ea8d926f08dc2d8d39ede", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/2ae7081bc10123b187e36a4f3a8e53768de31489", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/315552310c7de92baea4e570967066569937a843", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:21.269Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52596", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-06T15:39:37.053752Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:11.807Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "sysctl: Fix out of bounds access for empty sysctl registers", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "1da177e4c3f4", "lessThan": "15893975e9e3", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "2ae7081bc101", "versionType": "git"}, {"status": "affected", "version": "1da177e4c3f4", "lessThan": "315552310c7d", "versionType": "git"}], "programFiles": ["fs/proc/proc_sysctl.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "unaffected", "version": "6.6.16", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.4", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/proc/proc_sysctl.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/15893975e9e382f8294ea8d926f08dc2d8d39ede"}, {"url": "https://git.kernel.org/stable/c/2ae7081bc10123b187e36a4f3a8e53768de31489"}, {"url": "https://git.kernel.org/stable/c/315552310c7de92baea4e570967066569937a843"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsysctl: Fix out of bounds access for empty sysctl registers\n\nWhen registering tables to the sysctl subsystem there is a check to see\nif header is a permanently empty directory (used for mounts). This check\nevaluates the first element of the ctl_table. This results in an out of\nbounds evaluation when registering empty directories.\n\nThe function register_sysctl_mount_point now passes a ctl_table of size\n1 instead of size 0. It now relies solely on the type to identify\na permanently empty register.\n\nMake sure that the ctl_table has at least one element before testing for\npermanent emptiness."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T12:34:15.417Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52596", "state": "PUBLISHED", "dateUpdated": "2024-11-04T12:34:15.417Z", "dateReserved": "2024-03-02T21:55:42.571Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-03-06T06:45:26.094Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"bugzilla": {"description": "kernel: sysctl: Fix out of bounds access for empty sysctl registers", "id": "2268313", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2268313"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nsysctl: Fix out of bounds access for empty sysctl registers\nWhen registering tables to the sysctl subsystem there is a check to see\nif header is a permanently empty directory (used for mounts). This check\nevaluates the first element of the ctl_table. This results in an out of\nbounds evaluation when registering empty directories.\nThe function register_sysctl_mount_point now passes a ctl_table of size\n1 instead of size 0. It now relies solely on the type to identify\na permanently empty register.\nMake sure that the ctl_table has at least one element before testing for\npermanent emptiness.", "An out of bounds access flaw was found in empty sysctl registers in the Linux kernel. This may lead to a crash."], "name": "CVE-2023-52596", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-03-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-52596\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-52596\nhttps://lore.kernel.org/linux-cve-announce/2024030645-CVE-2023-52596-b98e@gregkh/T"], "statement": "Red Hat has protection mechanisms in place against buffer overflows such as FORTIFY_SOURCE, Position Independent Executables, or Stack Smashing Protection.", "threat_severity": "Moderate", "upstream_fix": "kernel 6.6.16, kernel 6.7.4, kernel 6.8-rc1"}