{ "data_version": "4.0", "data_type": "CVE", "data_format": "MITRE", "CVE_data_meta": { "ID": "CVE-2023-4459", "ASSIGNER": "secalert@redhat.com", "STATE": "PUBLIC" }, "description": { "description_data": [ { "lang": "eng", "value": "A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "NULL Pointer Dereference", "cweId": "CWE-476" } ] } ] }, "affects": { "vendor": { "vendor_data": [ { "vendor_name": "Red Hat", "product": { "product_data": [ { "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "version": "0:4.18.0-193.133.1.el8_2", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "defaultStatus": "affected" } } ] } }, { "product_name": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "version": "0:4.18.0-193.133.1.rt13.184.el8_2", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "defaultStatus": "affected" } }, { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "version": "0:4.18.0-193.133.1.el8_2", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "defaultStatus": "affected" } } ] } }, { "product_name": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "version": "0:4.18.0-193.133.1.el8_2", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "defaultStatus": "affected" } } ] } }, { "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "version": "0:4.18.0-305.125.1.el8_4", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "defaultStatus": "affected" } } ] } }, { "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "version": "0:4.18.0-305.125.1.rt7.201.el8_4", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "defaultStatus": "affected" } }, { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "version": "0:4.18.0-305.125.1.el8_4", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "defaultStatus": "affected" } } ] } }, { "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "version": "0:4.18.0-305.125.1.el8_4", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "defaultStatus": "affected" } } ] } }, { "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "version": "0:4.18.0-372.87.1.el8_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "defaultStatus": "affected" } } ] } }, { "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "version": "0:5.14.0-70.93.2.el9_0", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "defaultStatus": "affected" } }, { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "version": "0:5.14.0-70.93.1.rt21.165.el9_0", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "defaultStatus": "affected" } } ] } }, { "product_name": "Red Hat Virtualization 4 for Red Hat Enterprise Linux 8", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "versions": [ { "version": "0:4.18.0-372.87.1.el8_6", "lessThan": "*", "versionType": "rpm", "status": "unaffected" } ], "defaultStatus": "affected" } } ] } }, { "product_name": "Red Hat Enterprise Linux 6", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "defaultStatus": "unknown" } } ] } }, { "product_name": "Red Hat Enterprise Linux 7", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "defaultStatus": "unknown" } }, { "version_value": "not down converted", "x_cve_json_5_version_data": { "defaultStatus": "unknown" } } ] } }, { "product_name": "Red Hat Enterprise Linux 8", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "defaultStatus": "affected" } }, { "version_value": "not down converted", "x_cve_json_5_version_data": { "defaultStatus": "affected" } } ] } }, { "product_name": "Red Hat Enterprise Linux 9", "version": { "version_data": [ { "version_value": "not down converted", "x_cve_json_5_version_data": { "defaultStatus": "affected" } }, { "version_value": "not down converted", "x_cve_json_5_version_data": { "defaultStatus": "affected" } } ] } } ] } } ] } }, "references": { "reference_data": [ { "url": "https://access.redhat.com/errata/RHSA-2024:0412", "refsource": "MISC", "name": "https://access.redhat.com/errata/RHSA-2024:0412" }, { "url": "https://access.redhat.com/errata/RHSA-2024:1250", "refsource": "MISC", "name": "https://access.redhat.com/errata/RHSA-2024:1250" }, { "url": "https://access.redhat.com/errata/RHSA-2024:1306", "refsource": "MISC", "name": "https://access.redhat.com/errata/RHSA-2024:1306" }, { "url": "https://access.redhat.com/errata/RHSA-2024:1367", "refsource": "MISC", "name": "https://access.redhat.com/errata/RHSA-2024:1367" }, { "url": "https://access.redhat.com/errata/RHSA-2024:1382", "refsource": "MISC", "name": "https://access.redhat.com/errata/RHSA-2024:1382" }, { "url": "https://access.redhat.com/errata/RHSA-2024:2006", "refsource": "MISC", "name": "https://access.redhat.com/errata/RHSA-2024:2006" }, { "url": "https://access.redhat.com/errata/RHSA-2024:2008", "refsource": "MISC", "name": "https://access.redhat.com/errata/RHSA-2024:2008" }, { "url": "https://access.redhat.com/security/cve/CVE-2023-4459", "refsource": "MISC", "name": "https://access.redhat.com/security/cve/CVE-2023-4459" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2219268", "refsource": "MISC", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=2219268" }, { "url": "https://github.com/torvalds/linux/commit/edf410cb74dc612fd47ef5be319c5a0bcd6e6ccd", "refsource": "MISC", "name": "https://github.com/torvalds/linux/commit/edf410cb74dc612fd47ef5be319c5a0bcd6e6ccd" } ] }, "work_around": [ { "lang": "en", "value": "In order to mitigate this issue, prevent the affected code from being loaded by blacklisting the kernel module \"vmxnet3\". For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278\n~~~\nExploiting this flaw will require CAP_NET_ADMIN access privilege in any user or network namespace.\n~~~" } ], "impact": { "cvss": [ { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" } ] } }