CVE-2023-1513: Low severity Linux Linux kernel vulnerability
A flaw was found in KVM. When calling the KVMGETDEBUGREGS ioctl, on 32-bit systems, there might be some uninitialized portions of the kvmdebugregs structure that could be copied to userspace, causing an information leak.
Other sources
When calling the KVMGETDEBUGREGS ioctl, on some configurations (32-bit systems), there might be some unitialized portions of the kvmdebugregs structure that could be copied to userspace.
Upstream patch & commit: https://lore.kernel.org/kvm/20230214103304.3689213-1-gregkh@linuxfoundation.org/ https://github.com/torvalds/linux/commit/2c10b61421a28e95a46ab489fd56c0f442ff6952
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1513?
CVE-2023-1513 has been rated with a moderate severity due to its potential information leak risk.
How does CVE-2023-1513 affect system security?
CVE-2023-1513 can lead to exposure of uninitialized memory, which may leak sensitive information from the kernel to user space.
Which operating systems are affected by CVE-2023-1513?
CVE-2023-1513 impacts multiple versions of the Linux Kernel, as well as specific versions of Red Hat Enterprise Linux and Fedora.
How do I fix CVE-2023-1513?
To remediate CVE-2023-1513, upgrade to Linux Kernel version 6.2 or apply the latest patches provided by your distribution.
Is CVE-2023-1513 specific to 32-bit systems?
Yes, CVE-2023-1513 primarily affects 32-bit systems when using the KVM_GET_DEBUGREGS ioctl, leading to uninitialized data leaks.