CVE-2023-4273

MediumCVSS 6.7/10Last modified Oct 14, 2026

Description

A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Aug 9, 2023
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-427305.5In IMS service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to loCVE-2023-427314.4In Gnss service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with SysteCVE-2023-427325.5In telephony service, there is a possible missing permission check. This could lead to local information disclosure with no additional execuCVE-2023-427335.5In telephony service, there is a possible missing permission check. This could lead to local information disclosure with no additional execuCVE-2023-427345.5In telephony service, there is a possible missing permission check. This could lead to local information disclosure with no additional execuCVE-2023-427354.4In telephony service, there is a possible missing permission check. This could lead to local information disclosure with System execution prCVE-2023-427367.8In telecom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executCVE-2023-427375.5In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead tCVE-2023-427387.8In telocom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional executCVE-2023-427397.8In engineermode service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lCVE-2023-42746.5The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89.CVE-2023-427407.8In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead t
CVE-2023-4273: Medium severity, CVSS 6.7 | Vulnix