CVE-2023-6176
Description
A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to crash the system or escalate their privileges on the system.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | 4.7 | 4.7 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | High | High | High |
| Privileges Required | Low | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | None | None | None |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat CVSS v3 Score Explanation
The fail is null-ptr-deref, so unlikely that it can be used for anything apart from deny of service (this is the reason why CIA:NNH). Overall the actual patch is for the net/tls/tls_sw.c, but not for the function scatterwalk_copychunks in crypto/scatterwalk.c. It is known that possible to trigger only by race condition in TLS, because of: "TLS is asynchronously accelerated. When tls_do_encryption() returns -EINPROGRESS and sk-sk_err is set to EBADMSG due to rec_seq overflow, skmsg is released before the asynchronous encryption process ends.". It means that some complex race condition suppose to be triggered by local user and this user should be authorized for TLS usage (so I suggest AC:H or PR:H).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
