[kernel-cve-report] New CVE entries this week

[Masami Ichikawa <masami.ichikawa@miraclelinux.com>]

Hi!

It's this week's CVE report.

This week reported 3 new CVEs and 0 updated CVEs.

* New CVEs

CVE-2023-6121: nvmet: nul-terminate the NQNs passed in the connect command

CVSS v3(NIST): N/A
CVSS v3(CNA): 4.3 (MEDIUM)

An out-of-bounds read vulnerability was found in the NVMe-oF/TCP
subsystem in the Linux kernel. This flaw allows a remote attacker to
send a crafted TCP packet, triggering a heap-based buffer overflow
that results in kmalloc data to be printed (and potentially leaked) to
the kernel ring buffer (dmesg).

Fixed status
Patch is available at the linux-nvme list but it hasn't been merged yet.

CVE-2023-6176: A NULL pointer dereference bug was found in the net/tls/tls_sw.c

CVSS v3(NIST): N/A
CVSS v3(CNA): 4.4 (MEDIUM)

A null pointer dereference flaw was found in the Linux kernel API for
the cryptographic algorithm scatterwalk functionality. This issue
occurs when a user constructs a malicious packet with specific socket
configuration, which could allow a local user to crash the system or
escalate their privileges on the system.

This bug was introduced by commit 635d939 ("net/tls: free record only
on encryption error") in 5.7-rc7.
The commit 635d939 was backported to 5.4. So 5.4 or greater kernels
are affected by this issue.

Fixed status
mainline: [cfaa80c91f6f99b9342b6557f0f0e1143e434066]
stable/5.10: [a5096cc6e7836711541b7cd2d6da48d36fe420e9]
stable/5.15: [481bd6dcc5fe6c0ec57b61240ab552f67ff51b6b]
stable/5.4: [f9f3ce7719ebb437a883ae0db26723f17190df83]
stable/6.1: [7f4116c6f98412a6e29ace6d6a7b41ebb4e8a392]
stable/6.5: [74aecad5da19004ccf6321fd397d14b10756622a]

CVE-2023-6238: nvme: memory corruption via unprivileged user passthrough

CVSS v3(NIST): N/A
CVSS v3(CNA): 7.0 (HIGH)

A buffer overflow vulnerability was found in the NVM Express (NVMe)
driver in the Linux kernel. An unprivileged user could specify a small
meta buffer and let the device perform larger Direct Memory Access
(DMA) into the same buffer, overwriting unrelated kernel memory,
causing random kernel crashes and memory corruption.

Fixed status
Patch is available but it hasn't been merged yet.

* Updated CVEs

No updates


Currently tracking CVEs

CVE-2021-31615: Unencrypted Bluetooth Low Energy baseband links in
Bluetooth Core Specifications 4.0 through 5.2

There is no fix information.

CVE-2020-26556: kernel: malleable commitment Bluetooth Mesh Provisioning

No fix information.

CVE-2020-26557: kernel: predictable Authvalue in Bluetooth Mesh
Provisioning Leads to MITM

No fix information.

CVE-2020-26559: kernel: Authvalue leak in Bluetooth Mesh Provisioning

No fix information.

CVE-2020-26560: kernel: impersonation attack in Bluetooth Mesh Provisioning

No fix information.

Regards,
-- 
Masami Ichikawa
Cybertrust Japan Co., Ltd.

Email :masami.ichikawa@cybertrust.co.jp
          :masami.ichikawa@miraclelinux.com