CVE-2023-28772: linux linux_kernel Classic Buffer Overflow

CVSS: 6.7v3.1MediumModified

AliasesUBUNTU-CVE-2023-28772DEBIAN-CVE-2023-28772

Published 23-03-2023Last modified 05-05-2025

Vulnerability summary

CVE-2023-28772 is a medium (CVSS 6.7) Classic Buffer Overflow vulnerability in linux linux_kernel. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.9% of scored vulnerabilities.

Overall risk

27/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.7/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.71%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 13 · Related 9

RHSA-2023:6901 RHSA-2023:7077 RHSA-2024:0724 RHSA-2024:1404 SUSE-SU-2023:1800-1 SUSE-SU-2023:1801-1+7 more

Timeline

23-03-2023
PublishedVulnerability first disclosed.
05-05-2025
Last modifiedVulnerability information updated.

Description

An issue was discovered in the Linux kernel before 5.13.3. lib/seq_buf.c has a seq_buf_putmem_hex buffer overflow.

CVSS metrics

4 scores · 4 sources · 1 version

v3.16.7

EPSS trend

Probability

0.71%

Chance of exploitation in the next 30 days

Percentile

53%

Versus all other CVEs

30-day change

0.00 pp

From 0.71% on 22-09-2026

22-09-202622-10-2026

EPSS score

0.71%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Affected systems

Ubuntu65 products

linuxAll versions (No fix recorded) | < 4.15.0-156.163 | < 5.4.0-84.94
linux-awsAll versions (No fix recorded) | < 4.15.0-1111.118 | < 5.4.0-1056.59
linux-aws-5.0All versions (No fix recorded)
linux-aws-5.11All versions (No fix recorded)
linux-aws-5.13All versions (No fix recorded)

linux-aws-5.3All versions (No fix recorded)
linux-aws-5.4< 5.4.0-1056.59~18.04.1
linux-aws-5.8All versions (No fix recorded)
linux-aws-fips< 4.15.0-2053.55 | All versions (No fix recorded) | < 5.4.0-1069.73+fips2
linux-aws-hwe< 4.15.0-1111.118~16.04.1
linux-azure< 4.15.0-1123.136~14.04.1 | < 4.15.0-1123.136~16.04.1 | All versions (No fix recorded) | < 5.4.0-1058.60
linux-azure-4.15< 4.15.0-1123.136
linux-azure-5.11All versions (No fix recorded)
linux-azure-5.13All versions (No fix recorded)
linux-azure-5.3All versions (No fix recorded)
linux-azure-5.4< 5.4.0-1058.60~18.04.1
linux-azure-5.8All versions (No fix recorded)
linux-azure-edgeAll versions (No fix recorded)
linux-azure-fips< 4.15.0-2035.39 | All versions (No fix recorded) | < 5.4.0-1073.76+fips1
linux-bluefield< 5.4.0-1019.22
linux-dell300x< 4.15.0-1027.32
linux-fipsAll versions (No fix recorded) | < 4.15.0-1069.78 | < 5.4.0-1033.38
linux-gcp< 4.15.0-1108.122~16.04.1 | All versions (No fix recorded) | < 5.4.0-1052.56
linux-gcp-4.15< 4.15.0-1108.122
linux-gcp-5.11All versions (No fix recorded)
linux-gcp-5.13All versions (No fix recorded)
linux-gcp-5.3All versions (No fix recorded)
linux-gcp-5.4< 5.4.0-1052.56~18.04.1
linux-gcp-5.8All versions (No fix recorded)
linux-gcp-fips< 4.15.0-2018.20 | All versions (No fix recorded) | < 5.4.0-1067.71~20.04.1
linux-gke< 5.4.0-1052.55
linux-gke-4.15All versions (No fix recorded)
linux-gke-5.4All versions (No fix recorded)
linux-gkeop< 5.4.0-1023.24
linux-gkeop-5.4All versions (No fix recorded)
linux-hwe< 4.15.0-156.163~16.04.1 | All versions (No fix recorded)
linux-hwe-5.11All versions (No fix recorded)
linux-hwe-5.13All versions (No fix recorded)
linux-hwe-5.4< 5.4.0-84.94~18.04.1
linux-hwe-5.8All versions (No fix recorded)
linux-hwe-edgeAll versions (No fix recorded)
linux-intel-5.13All versions (No fix recorded)
linux-intel-iot-realtimeAll versions (No fix recorded)
linux-kvmAll versions (No fix recorded) | < 4.15.0-1099.101 | < 5.4.0-1046.48
linux-lts-xenialAll versions (No fix recorded)
linux-oemAll versions (No fix recorded)
linux-oem-5.10All versions (No fix recorded)
linux-oem-5.13All versions (No fix recorded)
linux-oem-5.6All versions (No fix recorded)
linux-oracle< 4.15.0-1080.88~16.04.1 | < 4.15.0-1080.88 | < 5.4.0-1054.58
linux-oracle-5.0All versions (No fix recorded)
linux-oracle-5.11All versions (No fix recorded)
linux-oracle-5.13All versions (No fix recorded)
linux-oracle-5.3All versions (No fix recorded)
linux-oracle-5.4< 5.4.0-1054.58~18.04.1
linux-oracle-5.8All versions (No fix recorded)
linux-raspi< 5.4.0-1043.47
linux-raspi-5.4< 5.4.0-1043.47~18.04.1
linux-raspi-realtimeAll versions (No fix recorded)
linux-raspi2< 4.15.0-1095.101 | All versions (No fix recorded)
linux-realtimeAll versions (No fix recorded)
linux-riscvAll versions (No fix recorded)
linux-riscv-5.11All versions (No fix recorded)
linux-riscv-5.8All versions (No fix recorded)
linux-snapdragon< 4.15.0-1112.121

Show all 65

Debian1 product

linux< 5.14.6-1

Linux1 product

linux_kernel≥ 2.6.27, < 4.4.276 | ≥ 4.5, < 4.9.276 | ≥ 4.10, < 4.14.240 | ≥ 4.15, < 4.19.198 | ≥ 4.20, < 5.4.133 | ≥ 5.5, < 5.10.51 | ≥ 5.11, < 5.12.18 | ≥ 5.13, < 5.13.3

3 vendors · 67 products