CVE-2023-34256

CVE Details

Release Date:

2023-05-31

Description

** DISPUTED ** An issue was discovered in the Linux kernel before 6.3.3. There is an out-of-bounds read in crc16 in lib/crc16.c when called from fs/ext4/super.c because ext4_group_desc_csum does not properly check an offset. NOTE: this is disputed by third parties because the kernel is not intended to defend against attackers with the stated "When modifying the block device while it is mounted by the filesystem" access.

See more information about CVE-2023-34256 from MITRE CVE dictionary and NIST NVD

CVSS v3.0 metrics

NOTE: The following CVSS v3.0 metrics and score provided are preliminary and subject to review.

Base Score:	5.5	Base Metrics:	AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Access Vector:	Local network	Attack Complexity:	Low
Privileges Required:	Low	User Interaction:	None
Scope:	Unchanged	Confidentiality Impact:	None
Integrity Impact:	None	Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 6 (kernel-uek)	ELSA-2023-12565	2023-07-04
Oracle Linux version 7 (kernel-uek)	ELSA-2023-12566	2023-07-04
Oracle VM version 3 (kernel-uek)	OVMSA-2023-0017	2023-08-03

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team