CVE-2023-4194

Katalog CVE

CVSS 5.5 · Medium EPSS 0,27%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada linux kernel, redhat enterprise linux +2 lainnya. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.

Rincian

Terbit di NVD

7 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CWE-863: Incorrect Authorization

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lore.kernel.org/all/20230731164237.48365-1-lersek@redhat.com/ mailing list · patch · advisory vendor
• https://lore.kernel.org/all/20230731164237.48365-2-lersek@redhat.com/ mailing list · patch · advisory vendor
• https://lore.kernel.org/all/20230731164237.48365-3-lersek@redhat.com/ mailing list · patch · advisory vendor
• https://access.redhat.com/errata/RHSA-2023:6583 advisory pihak ketiga
• https://access.redhat.com/security/cve/CVE-2023-4194 advisory pihak ketiga
• https://bugzilla.redhat.com/show_bug.cgi?id=2229498 issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/344H6HO6SSC4KT7...
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TYLSJ2SAI7RF56...
• https://security.netapp.com/advisory/ntap-20231027-0002/
• https://www.debian.org/security/2023/dsa-5480
• https://www.debian.org/security/2023/dsa-5492