CVE-2023-35788 Memory corruption in n/a
An out-of-bounds write in the Linux kernel flower classifier allows attackers to cause denial of service or escalate privileges via crafted GENEVE packets.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-35788?
CVE-2023-35788 is a high-severity memory corruption vulnerability in Canonical Ubuntu Linux, published on 16 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in fl_set_geneve_opt in net/sched/cls_flower.c in the Linux kernel before 6.3.7. It allows an out-of-bounds write in the flower classifier code via TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets. This may result in denial of service or privilege escalation.
Weakness: CWE-787
Which versions are affected by CVE-2023-35788?
It affects 8 products.
Linux distribution packages (40)
kpatch-patch-3_10_0-1160_83_1 Red Hat:enterprise_linux:7::server | All versions | 0:1-3.el7 |
kpatch-patch-3_10_0-1160_83_1-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:1-3.el7 |
kpatch-patch-3_10_0-1160_88_1 Red Hat:enterprise_linux:7::server | All versions | 0:1-2.el7 |
kpatch-patch-3_10_0-1160_88_1-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:1-2.el7 |
kpatch-patch-3_10_0-1160_90_1 Red Hat:enterprise_linux:7::server | All versions | 0:1-2.el7 |
kpatch-patch-3_10_0-1160_90_1-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:1-2.el7 |
kpatch-patch-3_10_0-1160_92_1 Red Hat:enterprise_linux:7::server | All versions | 0:1-2.el7 |
kpatch-patch-3_10_0-1160_92_1-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:1-2.el7 |
kpatch-patch-3_10_0-1160_95_1 Red Hat:enterprise_linux:7::server | All versions | 0:1-1.el7 |
kpatch-patch-3_10_0-1160_95_1-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:1-1.el7 |
bpftool Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
bpftool-debuginfo Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-abi-whitelists Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-debug Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-debug-debuginfo Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-debug-devel Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-debuginfo Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-debuginfo-common-x86_64 Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-devel Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-doc Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-tools Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-tools-debuginfo Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-tools-libs Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-tools-libs-devel Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
perf Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
perf-debuginfo Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
python-perf Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
python-perf-debuginfo Red Hat:rhel_aus:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
bpftool Red Hat:rhel_e4s:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
bpftool-debuginfo Red Hat:rhel_e4s:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel Red Hat:rhel_e4s:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-abi-whitelists Red Hat:rhel_e4s:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-bootwrapper Red Hat:rhel_e4s:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-debug Red Hat:rhel_e4s:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-debug-debuginfo Red Hat:rhel_e4s:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-debug-devel Red Hat:rhel_e4s:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-debuginfo Red Hat:rhel_e4s:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-debuginfo-common-ppc64le Red Hat:rhel_e4s:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
kernel-debuginfo-common-x86_64 Red Hat:rhel_e4s:7.7::server | All versions | 0:3.10.0-1062.77.1.el7 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Linux kernel, Netapp H300s Firmware, Netapp H410c Firmware, Netapp H410s Firmware and 2 more.
How do I fix CVE-2023-35788?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-35788 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-35788 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as AZL-27197, DEBIAN-CVE-2023-35788, GHSA-7jpg-h873-5g68, RHSA-2023:4697, RHSA-2023:4698, RHSA-2023:4834 and 7 more.