CVE-2023-4194

Updated: 2024-02-27 19:43:21.687866

Description:

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.


Links NIST CIRCL RHEL Ubuntu

Severity

Severity Score
CVSS Version 2.x 0
CVSS Version 3.x MEDIUM 5.5

Status

OS name Project name Version Score Severity Status Errata Last updated
AlmaLinux 9.2 ESU kernel 5.14.0 5.5 MEDIUM Ignored 2023-11-08 04:07:10
AlmaLinux 9.2 FIPS kernel 5.14.0 5.5 MEDIUM Ignored 2023-11-21 04:11:46
CentOS 6 ELS kernel 2.6.32 5.5 MEDIUM Ignored 2023-08-15 03:34:10
CentOS 7 ELS kernel 3.10.0 5.5 MEDIUM Ignored 2023-09-19 05:07:15
CentOS 8.4 ELS kernel 4.18.0 5.5 MEDIUM Ignored 2023-08-15 03:34:10
CentOS 8.5 ELS kernel 4.18.0 5.5 MEDIUM Ignored 2023-08-15 03:34:10
CloudLinux 6 ELS kernel 2.6.32 5.5 MEDIUM Ignored 2023-08-15 03:34:10
Oracle Linux 6 ELS kernel 2.6.32 5.5 MEDIUM Ignored 2023-08-15 05:05:48
Ubuntu 16.04 ELS linux-hwe 4.15.0 5.5 MEDIUM Ignored 2023-08-15 03:34:10
Ubuntu 16.04 ELS linux 4.4.0 5.5 MEDIUM Ignored 2023-08-15 05:05:48
Total: 11