CVE-2023-52614

CVE Details

Release Date:	2024-03-18
Impact:	Low	What is this?

Description

In the Linux kernel, the following vulnerability has been resolved:\nPM / devfreq: Fix buffer overflow in trans_stat_show\nFix buffer overflow in trans_stat_show().\nConvert simple snprintf to the more secure scnprintf with size of\nPAGE_SIZE.\nAdd condition checking if we are exceeding PAGE_SIZE and exit early from\nloop. Also add at the end a warning that we exceeded PAGE_SIZE and that\nstats is disabled.\nReturn -EFBIG in the case where we don't have enough space to write the\nfull transition table.\nAlso document in the ABI that this function can return -EFBIG error.

See more information about CVE-2023-52614 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	4.4
Vector String:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Version:	3.1
Attack Vector:	Local
Attack Complexity:	Low
Privileges Required:	High
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	High
Integrity Impact:	None
Availability Impact:	None

Errata information

Platform	Errata	Release Date
Oracle Linux version 9 (kernel)	ELSA-2024-9315	2024-11-14