CVE-2023-0459

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-763

Affected software

Vendor	Product	Versions
Linux	Linux Kernel	>= 4b842e4e25b12951fa10dedb4bc16bc47e3b850c, <= 74e19ef0ff8061ef55957c3abd71614ef0f42f47

References

Timeline

Published: May 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-04607.3The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Conte CVE-2023-04617.8There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulne CVE-2023-04629.1An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operat CVE-2023-04633.3The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022 CVE-2023-04647.5A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains t CVE-2023-04655.3Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent cert CVE-2023-04665.3The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verifica CVE-2023-04674.3The WP Dark Mode WordPress plugin before 4.0.8 does not properly sanitize the style parameter in shortcodes before using it to load a PHP te CVE-2023-04684.7A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Kernel due to a race co CVE-2023-04695.5A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent in the Linux Kernel during cal CVE-2023-04705.4Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-04718.8Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via