CVE-2023-2176: High severity Linux Linux kernel vulnerability
A vulnerability was found in comparenetdevandip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. The improper cleanup results in out-of-boundary read, where a local user can utilize this problem to crash the system or escalation of privilege.
Other sources
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by an out-of-bounds read flaw in the comparenetdevandip function in drivers/infiniband/core/cma.c in RDMA. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges or cause the system to crash.
— IBM
The improper cleanup of resolvepreparesrc leads to a key mismatch or duplicate key in the cma id tree, which results in out-of-boundary in comparenetdevandip. The issue was found in drivers/infiniband/core/cma.c in Linux in 6.1. A local user can utilize this bug to crash the system or escalation of privilege.
Affected component: rdma driver
References: https://lkml.org/lkml/2022/12/9/178 https://www.spinics.net/lists/linux-rdma/msg114749.html https://patchwork.kernel.org/project/linux-rdma/patch/3d0e9a2fd62bc10ba02fed1c7c48a48638952320.1672819273.git.leonro@nvidia.com/
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2176?
CVE-2023-2176 has a high severity rating due to its potential for system crashes and privilege escalation.
How do I fix CVE-2023-2176?
To mitigate CVE-2023-2176, users should upgrade to the latest patched versions of the Linux Kernel and any affected IBM Security Verify Governance components.
Which software components are affected by CVE-2023-2176?
CVE-2023-2176 affects the Linux Kernel versions from 6.0 to 6.3 and IBM Security Verify Governance, Identity Manager components up to version ISVG 10.0.2.
Can CVE-2023-2176 be exploited remotely?
CVE-2023-2176 is primarily applicable to local users, as it requires local access to exploit the vulnerability.
What are the potential impacts of CVE-2023-2176?
Exploiting CVE-2023-2176 can lead to system crashes and unauthorized escalation of privileges on the affected systems.