CVE-2023-39194

MediumCVSS 4.4/10Last modified Oct 15, 2026

Description

A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

No affected versions have been published.

Timeline

Published
Oct 9, 2023
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-391965.3Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage CoCVE-2023-391977.5An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote usCVE-2023-391986.4A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the CVE-2023-391996.5Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via networkCVE-2023-39204.3An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.CVE-2023-392016.7Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local aCVE-2023-392025.5Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via loCVE-2023-392037.5Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated useCVE-2023-392047.5Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access.CVE-2023-392056.5Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network acceCVE-2023-392067.5Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access.CVE-2023-392087.5Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of s