-

CVE-2023-53680

In the Linux kernel, the following vulnerability has been resolved:

NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

OPDESC() simply indexes into nfsd4_ops[] by the op's operation
number, without range checking that value. It assumes callers are
careful to avoid calling it with an out-of-bounds opnum value.

nfsd4_decode_compound() is not so careful, and can invoke OPDESC()
with opnum set to OP_ILLEGAL, which is 10044 -- well beyond the end
of nfsd4_ops[].

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
VendorLinux
≫
Product Linux
Default Statusunaffected
Version < 50827896c365e0f6c8b55ed56d444dafd87c92c5
Version f4f9ef4a1b0a1ca80b152e28e176d69515bdf7e8
Status affected
Version < a64160124d5a078be0c380b1e8a0bad2d040d3a1
Version f4f9ef4a1b0a1ca80b152e28e176d69515bdf7e8
Status affected
Version < ffcbcf087581ae68ddc0a21460f7ecd4315bdd0e
Version f4f9ef4a1b0a1ca80b152e28e176d69515bdf7e8
Status affected
Version < f352c41fa718482979e7e6b71b4da2b718e381cc
Version f4f9ef4a1b0a1ca80b152e28e176d69515bdf7e8
Status affected
Version < 804d8e0a6e54427268790472781e03bc243f4ee3
Version f4f9ef4a1b0a1ca80b152e28e176d69515bdf7e8
Status affected
VendorLinux
≫
Product Linux
Default Statusaffected
Version 4.14
Status affected
Version < 4.14
Version 0
Status unaffected
Version <= 5.10.*
Version 5.10.220
Status unaffected
Version <= 5.15.*
Version 5.15.107
Status unaffected
Version <= 6.1.*
Version 6.1.24
Status unaffected
Version <= 6.2.*
Version 6.2.11
Status unaffected
Version <= *
Version 6.3
Status unaffected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string