CVE-2023-52452

CVSS 3.1 Score 7.8 of 10 (high)

Details

Published Feb 22, 2024
Updated: Mar 18, 2024
CWE ID 665

Summary

CVE-2023-52452 is a vulnerability affecting the Linux kernel that allowed privileged programs to access uninitialized stack memory inconsistently. The issue was due to inconsistent permission of stack accesses above and below the allocated stack size. Two functions, check_stack_slot_within_bounds() and check_stack_range_initialized(), were affected. The patch enables privileged programs to read uninitialized stack memory consistently, regardless of the stack size. Additionally, the patch fixes the tracking of stack size for variable-offset reads, ensuring that the correct maximum stack size is maintained. This reduces the risk of out-of-bounds data reads at runtime. A few tests were updated to reflect these changes, and one test, verifier_var_off:stack_write_priv_vs_unpriv, failed without the patch due to the stack depth computation issue.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share