Skip to content
CVE PROGRAM SOURCE RECORD7.8 High

CVE-2023-6931

Out-of-bounds write in Linux kernel's Performance Events system component

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Google

Description

A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux Kernel

Default version status: unaffected

  • 4.3.0 to < 4.19.302affected
  • 4.20.0 to < 5.4.264affected
  • 5.5.0 to < 5.10.204affected
  • 5.11.0 to < 5.15.143affected
  • 5.16.0 to < 6.1.68affected
  • 6.2.0 to < 6.6.7affected
  • 6.7.0unaffected
  • 382c27f4ed28f803b1f1473ac2d8db0afc795a1bunaffected

References