CVE-2023-0458

Aliases:UBUNTU-CVE-2023-0458DEBIAN-CVE-2023-0458
Advisory lineage Upstream: 0 Downstream: 21
Modified
Published: 26 Apr 2023, 18:03
Last modified:13 Feb 2025, 16:38

Vulnerability Summary

Overall Risk (default)
low
21/100
CVSS Score
5.3 MEDIUM
v3.1 (cve.org)
EPSS Score
0.72% LOW
1% probability +0.64%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

26 Apr 2023, 18:03
Published
Vulnerability first disclosed
13 Feb 2025, 16:38
Last Modified
Vulnerability information updated

Description

A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or commit 739790605705ddcf18f21782b9c99ad7d53a8c11

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
  • v3.1•MEDIUM•Score: 4.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Trends

Current EPSS score: 0.72%• Percentile: 52%

Techniques & Countermeasures

  • CWE-476•NULL Pointer Dereference

    The product dereferences a pointer that it expects to be valid but is NULL.

Affected Systems

  • debian•linux

    < 5.10.178-1 | < 6.1.8-1 | < 6.1.8-1 | < 6.1.8-1

  • ubuntu•linux

    < 3.13.0-193.244 | < 4.4.0-243.277 | < 4.15.0-209.220 | < 5.4.0-147.164 | < 5.15.0-70.77

  • ubuntu•linux-allwinner-5.19

    < 5.19.0-1012.12~22.04.1

  • ubuntu•linux-aws

    < 4.4.0-1121.127 | < 4.4.0-1159.174 | < 4.15.0-1154.167 | < 5.4.0-1100.108 | < 5.15.0-1034.38

  • ubuntu•linux-aws-5.0

    all

  • ubuntu•linux-aws-5.11

    all

  • ubuntu•linux-aws-5.13

    all

  • ubuntu•linux-aws-5.15

    < 5.15.0-1034.38~20.04.1

  • ubuntu•linux-aws-5.3

    all

  • ubuntu•linux-aws-5.4

    < 5.4.0-1100.108~18.04.1

  • ubuntu•linux-aws-5.8

    all

  • ubuntu•linux-aws-fips

    < 4.15.0-2093.99 | all | < 5.4.0-1100.108+fips1

  • ubuntu•linux-aws-hwe

    < 4.15.0-1154.167~16.04.1

  • ubuntu•linux-azure

    < 4.15.0-1163.178~14.04.1 | < 4.15.0-1163.178~16.04.1 | all | < 5.4.0-1106.112 | < 5.15.0-1036.43

  • ubuntu•linux-azure-4.15

    < 4.15.0-1163.178

  • ubuntu•linux-azure-5.11

    all

  • ubuntu•linux-azure-5.13

    all

  • ubuntu•linux-azure-5.15

    < 5.15.0-1036.43~20.04.1

  • ubuntu•linux-azure-5.19

    < 5.19.0-1026.29~22.04.1

  • ubuntu•linux-azure-5.3

    all

  • ubuntu•linux-azure-5.4

    < 5.4.0-1106.112~18.04.1

  • ubuntu•linux-azure-5.8

    all

  • ubuntu•linux-azure-edge

    all

  • ubuntu•linux-azure-fde

    < 5.15.0-1036.43.1

  • ubuntu•linux-azure-fips

    < 4.15.0-2072.78 | all | < 5.4.0-1106.112+fips1

  • ubuntu•linux-bluefield

    all | < 5.4.0-1062.68 | < 5.15.0-1015.17

  • ubuntu•linux-dell300x

    < 4.15.0-1063.68

  • ubuntu•linux-fips

    < 4.4.0-1091.98 | all | < 4.15.0-1109.120 | < 5.4.0-1075.84

  • ubuntu•linux-gcp

    < 4.15.0-1148.164~16.04.1 | all | < 5.4.0-1103.112 | < 5.15.0-1032.40

  • ubuntu•linux-gcp-4.15

    < 4.15.0-1148.164

  • ubuntu•linux-gcp-5.11

    all

  • ubuntu•linux-gcp-5.13

    all

  • ubuntu•linux-gcp-5.15

    < 5.15.0-1032.40~20.04.1

  • ubuntu•linux-gcp-5.19

    < 5.19.0-1024.26~22.04.1

  • ubuntu•linux-gcp-5.3

    all

  • ubuntu•linux-gcp-5.4

    < 5.4.0-1103.112~18.04.1

  • ubuntu•linux-gcp-5.8

    all

  • ubuntu•linux-gcp-fips

    < 4.15.0-2056.61 | all | < 5.4.0-1103.112+fips1

  • ubuntu•linux-gke

    < 5.4.0-1097.104 | < 5.15.0-1031.36

  • ubuntu•linux-gke-4.15

    all

  • ubuntu•linux-gke-5.15

    < 5.15.0-1031.36~20.04.1

  • ubuntu•linux-gke-5.4

    all

  • ubuntu•linux-gkeop

    < 5.4.0-1067.71 | < 5.15.0-1018.23

  • ubuntu•linux-gkeop-5.15

    < 5.15.0-1018.23~20.04.1

  • ubuntu•linux-gkeop-5.4

    all

  • ubuntu•linux-hwe

    < 4.15.0-209.220~16.04.1 | all

  • ubuntu•linux-hwe-5.11

    all

  • ubuntu•linux-hwe-5.13

    all

  • ubuntu•linux-hwe-5.15

    < 5.15.0-70.77~20.04.1

  • ubuntu•linux-hwe-5.19

    < 5.19.0-42.43~22.04.1

Showing first 50 affected entries in server-rendered view.

References (19)