OESA-2023-1760

Dashboard / Vulnerabilities / OESA-2023-1760

OESA-2023-1760

Summary: kernel security update

Details: The Linux Kernel, the operating system core itself. Security Fix(es): A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39189) A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.(CVE-2023-39193)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1760, https://nvd.nist.gov/vuln/detail/CVE-2023-39189, https://nvd.nist.gov/vuln/detail/CVE-2023-39193