7.8

CVE-2023-34319

The fix for XSA-423 added logic to Linux'es netback driver to deal with
a frontend splitting a packet in a way such that not all of the headers
would come in one piece.  Unfortunately the logic introduced there
didn't account for the extreme case of the entire packet being split
into as many pieces as permitted by the protocol, yet still being
smaller than the area that's specially dealt with to keep all (possible)
headers together.  Such an unusual packet would therefore trigger a
buffer overrun in the driver.

Data is provided by the National Vulnerability Database (NVD)
Xen ≫ Xen HwPlatformx86 Version >= 3.2.0
Debian ≫ Debian Linux Version10.0
Linux ≫ Linux Kernel Version >= 4.9.336 < 4.10
Linux ≫ Linux Kernel Version >= 4.14.302 < 4.14.321
Linux ≫ Linux Kernel Version >= 4.19.269 < 4.19.290
Linux ≫ Linux Kernel Version >= 5.4.227 < 5.4.252
Linux ≫ Linux Kernel Version >= 5.10.159 < 5.10.189
Linux ≫ Linux Kernel Version >= 5.15.83 < 5.15.125
Linux ≫ Linux Kernel Version >= 6.1.13 < 6.1.44
Linux ≫ Linux Kernel Version >= 6.2 < 6.4.9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.02% 0.019
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.