CVE-2023-1078: linux linux_kernel Out-of-bounds Write
Vulnerability summary
CVE-2023-1078 is a high (CVSS 7.8) Out-of-bounds Write vulnerability in linux linux_kernel. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 16.3% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 38 · Related 34Timeline
- 27-03-2023PublishedVulnerability first disclosed.
- 05-05-2025Last modifiedVulnerability information updated.
Description
A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an out of bounds access, and a lock corruption.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.25% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
- CWE-843Access of Resource Using Incompatible TypeThe product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Affected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu85 products
- linux< 5.4.0-149.166 | < 5.15.0-72.79
- linux-aws< 5.4.0-1102.110 | < 5.15.0-1036.40
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
- linux-aws-5.13All versions (No fix recorded)
Suse2 products
- kernel-livepatch-SLE15-SP2_Update_34&distro=SUSE Linux Enterprise Live Patching 15 SP2< 2-150200.2.3
- kernel-livepatch-SLE15-SP3_Update_30&distro=SUSE Linux Enterprise Live Patching 15 SP3< 2-150300.2.3
Debian1 product
- linux< 6.1.12-1
Linux1 product
- linux_kernel≥ 4.17, < 4.19.273 | ≥ 4.20, < 5.4.232 | ≥ 5.5, < 5.10.168 | ≥ 5.11, < 5.15.94 | ≥ 5.16, < 6.1.12
Opensuse1 product
- kernel-source&distro=openSUSE Tumbleweed< 6.2.8-1.1
5 vendors · 90 products
References
28 links
- security.netapp.com/advisory/ntap-20230505-0004/Third Party Advisory
- www.openwall.com/lists/oss-security/2023/11/05/1Mailing List