An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
CVE-2023-6121 - Medium Severity Vulnerability
Vulnerable Library - linux-yoctov5.4.51
Yocto Linux Embedded kernel
Library home page: https://git.yoctoproject.org/git/linux-yocto
Found in HEAD commit: 662967c12efbaddc3a053fdcbe4461a3a774fd7f
Found in base branch: master
Vulnerable Source Files (2)
/drivers/nvme/target/fabrics-cmd.c /drivers/nvme/target/fabrics-cmd.c
Vulnerability Details
An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potentially leaked to the kernel ring buffer (dmesg).
Publish Date: 2023-11-16
URL: CVE-2023-6121
CVSS 3 Score Details (4.3)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://www.linuxkernelcves.com/cves/CVE-2023-6121
Release Date: 2023-11-16
Fix Resolution: v5.15.141,v6.1.65,v6.6.4
Step up your Open Source Security Game with Mend here