CVE-2023-2194: Medium severity Linux Linux kernel vulnerability
An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The flaw lies in the xgeneslimproi2cxfer() function. Quoting the upstream commit below: "The data->block[0] variable comes from user and is a number between 0-255. Without proper check, the variable may be very large to cause an out-of-bounds when performing memcpy in slimproi2cblkwr."
Upstream fix: https://github.com/torvalds/linux/commit/92fbb6d1296f
Other sources
An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dmabuffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution.
— Launchpad
Linux Kernel could allow a local authenticated attacker to execute arbitrary code on the system, caused by an out-of-bounds write flaw in the SLIMpro I2C device driver. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause the system to crash.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-2194?
CVE-2023-2194 has been classified as a high-severity vulnerability due to the potential for an out-of-bounds write in the Linux kernel.
How do I fix CVE-2023-2194?
To fix CVE-2023-2194, update the Linux kernel to version 6.3 or later, or apply the appropriate patches provided by your distribution.
What versions of Linux are affected by CVE-2023-2194?
CVE-2023-2194 affects Linux kernel versions up to and including 6.3 as well as specific versions of IBM Security Verify Governance software components.
Is CVE-2023-2194 present in Red Hat Enterprise Linux?
Yes, CVE-2023-2194 is present in Red Hat Enterprise Linux versions up to 9.0 and requires updates to mitigate the vulnerability.
What is the impact of exploiting CVE-2023-2194?
Exploiting CVE-2023-2194 could allow an attacker to execute arbitrary code with elevated privileges, leading to system compromise.