Oracle Linux: CVE-2023-2194: ELSA-2023-3723: kernel security and bug fix update (IMPORTANT) (Multiple Advisories)

Oracle Linux: CVE-2023-2194: ELSA-2023-3723:kernel security and bug fix update (IMPORTANT) (Multiple Advisories)

Severity

6

CVSS

(AV:L/AC:L/Au:M/C:C/I:C/A:C)

Published

03/16/2023

Created

07/26/2023

Added

07/25/2023

Modified

12/06/2024

Description

An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution. An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not limited to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This issue could allow a local privileged user to crash the system or potentially achieve code execution.

Solution(s)

• oracle-linux-upgrade-kernel

References

• https://attackerkb.com/topics/cve-2023-2194
• CVE - 2023-2194
• ELSA-2023-3723
• ELSA-2023-4517