CVE-2023-52436

HIGH

Linux Kernel < 4.19.306 - Information Disclosure via Uninitialized Xattr List

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: f2fs: explicitly null-terminate the xattr list When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed.

References (10)

Core 10
Core References

Scores

CVSS v3 7.8
EPSS 0.0030
EPSS Percentile 22.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

Status published
Products (26)
linux/Kernel 3.8.0 - 4.19.306linux
linux/Kernel 4.20.0 - 5.4.268linux
linux/Kernel 5.11.0 - 5.15.148linux
linux/Kernel 5.16.0 - 6.1.74linux
linux/Kernel 5.5.0 - 5.10.209linux
linux/Kernel 6.2.0 - 6.6.13linux
linux/Kernel 6.7.0 - 6.7.1linux
Linux/Linux < 3.8
Linux/Linux 3.8
Linux/Linux 4.19.306 - 4.19.*
... and 16 more
Published Feb 20, 2024
Tracked Since Feb 18, 2026