OESA-2023-1764

Dashboard / Vulnerabilities / OESA-2023-1764

OESA-2023-1764

Summary: kernel security update

Details: The Linux Kernel, the operating system core itself. Security Fix(es): A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure.(CVE-2023-39192) A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system.(CVE-2023-42754) An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.(CVE-2023-45871)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1764, https://nvd.nist.gov/vuln/detail/CVE-2023-39192, https://nvd.nist.gov/vuln/detail/CVE-2023-42754, https://nvd.nist.gov/vuln/detail/CVE-2023-45871