CVE-2023-35788 : An issue was discovered in fl_set_geneve_opt in net/sched/cls

An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation.

Published 2023-06-16 21:15:09

Updated 2024-06-26 15:55:02

Source MITRE

View at NVD, CVE.org

Vulnerability category: Gain privilegeDenial of service

Products affected by CVE-2023-35788

Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 12.0
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 6.2 and before (<) 6.3.7
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.5 and before (<) 5.10.183
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.20 and before (<) 5.4.246
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.11 and before (<) 5.15.116
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 5.16 and before (<) 6.1.33
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 4.19 and before (<) 4.19.285
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 18.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 16.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 20.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 22.04 LTS Edition
cpe:2.3:o:canonical:ubuntu_linux:22.04:*:*:*:lts:*:*:*
Matching versions
Netapp » H410c Firmware » Version: N/A
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H410c » Version: N/A
Netapp » H300s Firmware » Version: N/A
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H300s » Version: N/A
Netapp » H500s Firmware » Version: N/A
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H500s » Version: N/A
Netapp » H700s Firmware » Version: N/A
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H700s » Version: N/A
Netapp » H410s Firmware » Version: N/A
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
Matching versions
When used together with: Netapp » H410s » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-35788

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 29 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-35788

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.8	HIGH	AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	N/A	N/A	Oracle:CPUOct2023
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2023-35788

CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2023-35788

https://www.debian.org/security/2023/dsa-5480

Debian -- Security Information -- DSA-5480-1 linux
Third Party Advisory

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html

[SECURITY] [DLA 3508-1] linux security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20230714-0002/

CVE-2023-35788 Linux Kernel Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/06/17/1

oss-security - Re: Linux kernel: off-by-one in fl_set_geneve_opt
Exploit;Mailing List
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.7

Mailing List;Patch
http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html

Kernel Live Patch Security Notice LSN-0097-1 ≈ Packet Storm
Third Party Advisory;VDB Entry

CVEs referencing this url
https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html

[SECURITY] [DLA 3623-1] linux-5.10 security update
Mailing List;Third Party Advisory

CVEs referencing this url
https://www.openwall.com/lists/oss-security/2023/06/07/1

oss-security - Linux kernel: off-by-one in fl_set_geneve_opt
Exploit;Mailing List
https://www.debian.org/security/2023/dsa-5448

Debian -- Security Information -- DSA-5448-1 linux
Third Party Advisory

CVEs referencing this url
https://git.kernel.org/linus/4d56304e5827c8cc8cc18c75343d283af7c4825c

kernel/git/torvalds/linux.git - Linux kernel source tree
Patch

Jump to

Vulnerability Details : CVE-2023-35788

Products affected by CVE-2023-35788

Exploit prediction scoring system (EPSS) score for CVE-2023-35788

CVSS scores for CVE-2023-35788

CWE ids for CVE-2023-35788

References for CVE-2023-35788