CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
15.5%
In the Linux kernel, the following vulnerability has been resolved:
s390/decompressor: specify __decompress() buf len to avoid overflow
Historically calls to __decompress() didn’t specify “out_len” parameter on
many architectures including s390, expecting that no writes beyond
uncompressed kernel image are performed. This has changed since commit
2aa14b1ab2c4 (“zstd: import usptream v1.5.2”) which includes zstd library
commit 6a7ede3dfccb (“Reduce size of dctx by reutilizing dst buffer
(#2751)”). Now zstd decompression code might store literal buffer in the
unwritten portion of the destination buffer. Since “out_len” is not set, it
is considered to be unlimited and hence free to use for optimization needs.
On s390 this might corrupt initrd or ipl report which are often placed
right after the decompressor buffer. Luckily the size of uncompressed
kernel image is already known to the decompressor, so to avoid the problem
simply specify it in the “out_len” parameter.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ubuntu | 20.04 | noarch | linux | < any | UNKNOWN |
ubuntu | 22.04 | noarch | linux | < any | UNKNOWN |
ubuntu | 20.04 | noarch | linux-aws | < any | UNKNOWN |
ubuntu | 22.04 | noarch | linux-aws | < any | UNKNOWN |
ubuntu | 20.04 | noarch | linux-aws-5.15 | < any | UNKNOWN |
ubuntu | 18.04 | noarch | linux-aws-5.4 | < any | UNKNOWN |
ubuntu | 20.04 | noarch | linux-azure | < any | UNKNOWN |
ubuntu | 22.04 | noarch | linux-azure | < any | UNKNOWN |
ubuntu | 20.04 | noarch | linux-azure-5.15 | < any | UNKNOWN |
ubuntu | 18.04 | noarch | linux-azure-5.4 | < any | UNKNOWN |
git.kernel.org/linus/7ab41c2c08a32132ba8c14624910e2fe8ce4ba4b (6.2-rc7)
git.kernel.org/stable/c/16409f7d9ca5bb8220e1049ea9aae0d3c94d2dfb
git.kernel.org/stable/c/55dbd6f4ea954751340f4f73d5dcd7c8f12208b2
git.kernel.org/stable/c/7ab41c2c08a32132ba8c14624910e2fe8ce4ba4b
git.kernel.org/stable/c/9ed522143f959630f8b7782ddc212900d8f609a9
git.kernel.org/stable/c/f1eb22d0ff064ad458b3b1a1eaa84ac3996206c2
launchpad.net/bugs/cve/CVE-2023-52733
nvd.nist.gov/vuln/detail/CVE-2023-52733
security-tracker.debian.org/tracker/CVE-2023-52733
www.cve.org/CVERecord?id=CVE-2023-52733