CVE-2023-52452
CVSS 3.1 Score 7.8 of 10 (high)
Details
Summary
CVE-2023-52452 is a vulnerability affecting the Linux kernel that allowed privileged programs to access uninitialized stack memory inconsistently. The issue was due to inconsistent permission of stack accesses above and below the allocated stack size. Two functions, check_stack_slot_within_bounds() and check_stack_range_initialized(), were affected. The patch enables privileged programs to read uninitialized stack memory consistently, regardless of the stack size. Additionally, the patch fixes the tracking of stack size for variable-offset reads, ensuring that the correct maximum stack size is maintained. This reduces the risk of out-of-bounds data reads at runtime. A few tests were updated to reflect these changes, and one test, verifier_var_off:stack_write_priv_vs_unpriv, failed without the patch due to the stack depth computation issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions