CVE-2023-2860

NameCVE-2023-2860
DescriptionAn out-of-bounds read vulnerability was found in the SR-IPv6 implementation in the Linux kernel. The flaw exists within the processing of seg6 attributes. The issue results from the improper validation of user-supplied data, which can result in a read past the end of an allocated buffer. This flaw allows a privileged local user to disclose sensitive information on affected installations of the Linux kernel.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)buster4.19.249-2vulnerable
buster (security)4.19.289-2fixed
bullseye5.10.178-3fixed
bullseye (security)5.10.191-1fixed
bookworm6.1.38-1fixed
bookworm (security)6.1.52-1fixed
trixie6.4.13-1fixed
sid6.5.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsourcebuster4.19.260-1
linuxsourcebullseye5.10.148-1
linuxsource(unstable)5.19.11-1

Notes

https://www.zerodayinitiative.com/advisories/ZDI-CAN-18511/
https://git.kernel.org/linus/84a53580c5d2138c7361c7c3eea5b31827e63b35 (6.0-rc5)

Search for package or bug name: Reporting problems