Vulnerability Description
A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 4.3, < 6.7 |
| Debian | Debian Linux | 10.0 |
Related Weaknesses (CWE)
References
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=382cMailing ListPatch
- https://kernel.dance/382c27f4ed28f803b1f1473ac2d8db0afc795a1bPatch
- https://lists.debian.org/debian-lts-announce/2024/01/msg00004.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/01/msg00005.htmlMailing ListThird Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=382cMailing ListPatch
- https://kernel.dance/382c27f4ed28f803b1f1473ac2d8db0afc795a1bPatch
- https://lists.debian.org/debian-lts-announce/2024/01/msg00004.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/01/msg00005.htmlMailing ListThird Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-613116.html
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html
FAQ
What is CVE-2023-6931?
CVE-2023-6931 is a vulnerability with a CVSS score of 7.8 (HIGH). A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leadi...
How severe is CVE-2023-6931?
CVE-2023-6931 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-6931?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Debian Debian Linux.