5.5

CVE-2023-3772

Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()

A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Enterprise Linux Version8.0
Redhat ≫ Enterprise Linux Version9.0
Fedoraproject ≫ Fedora Version-
Linux ≫ Linux Kernel Version-
Debian ≫ Debian Linux Version10.0
Debian ≫ Debian Linux Version12.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.45% 0.359
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.4 0.8 3.6
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
secalert@redhat.com 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
https://www.debian.org/security/2023/dsa-5492
https://access.redhat.com/errata/RHSA-2023:6583
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6901
Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7077
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0412
https://access.redhat.com/errata/RHSA-2024:0575
https://access.redhat.com/security/cve/CVE-2023-3772
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2218943
Third Party Advisory
Issue Tracking
http://www.openwall.com/lists/oss-security/2023/08/10/1
http://www.openwall.com/lists/oss-security/2023/08/10/3