CVE-2023-23003 : In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap_

In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value.

Published 2023-03-01 20:15:14

Updated 2023-08-29 17:56:28

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2023-23003

Probability of exploitation activity in the next 30 days: 0.04%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H	0.3	3.6	NIST
Attack Vector: Local Attack Complexity: High Privileges Required: High User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE-252 Unchecked Return Value

The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.

Assigned by: nvd@nist.gov (Primary)

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16

Mailing List;Patch;Vendor Advisory
https://security.netapp.com/advisory/ntap-20230331-0003/

CVE-2023-23003 Linux Kernel Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://github.com/torvalds/linux/commit/0a515a06c5ebfa46fee3ac519e418f801e718da4

perf expr: Fix missing check for return value of hashmap__new() · torvalds/linux@0a515a0 · GitHub
Patch

Linux » Linux Kernel
Versions before (<) 5.16
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions