CVE-2023-2008
Kernel: udmabuf: improper validation of array index leading to local privilege escalation
HIGH 8.2EPSS 1.0%
A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
- Affected
- Linux · Red Hat · kernel · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 9.0 Extended Update Support · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8
- CVSS v3.1 REDHAT
- 8.2 HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS v3.1 NVD
- 7.8 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- 1.01% chance of exploitation in the next 30 days, 62nd percentile
- Published
- 2023-04-14
- Updated
- 2026-08-10
Proof-of-concept exploits (2)
- bluefrostsecurity/CVE-2023-200839★ · 2023-06-12
- IdanBanani/Linux-Kernel-VR-Exploitation68★ · 2023-12-12
Security advisories
- https://bugzilla.redhat.com/show_bug.cgi?id=2186862
- https://security.netapp.com/advisory/ntap-20230517-0007
- https://www.zerodayinitiative.com/advisories/ZDI-23-441
- torvalds/linux/commit/05b252cccb2e5c3f56119d25de684b4f810ba4