CVE-2023-46813 Affecting kernel-uek-core package, versions <0:5.15.0-203.146.5.1.el8uek
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ORACLE8-KERNELUEKCORE-6249052
- published 16 Feb 2024
- disclosed 27 Oct 2023
Introduced: 27 Oct 2023
CVE-2023-46813 Open this link in a new tabHow to fix?
Upgrade Oracle:8 kernel-uek-core to version 0:5.15.0-203.146.5.1.el8uek or higher.
This issue was patched in ELSA-2024-12159.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-uek-core package and not the kernel-uek-core package as distributed by Oracle.
See How to fix? for Oracle:8 relevant fixed versions and status.
An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the #VC handler and instruction emulation of the SEV-ES emulation of MMIO accesses could lead to arbitrary write access to kernel memory (and thus privilege escalation). This depends on a race condition through which userspace can replace an instruction before the #VC handler reads it.
References
- https://linux.oracle.com/cve/CVE-2023-46813.html
- https://linux.oracle.com/errata/ELSA-2024-0461.html
- https://linux.oracle.com/errata/ELSA-2024-0897.html
- https://linux.oracle.com/errata/ELSA-2024-12094.html
- https://linux.oracle.com/errata/ELSA-2024-12159.html
- https://linux.oracle.com/errata/ELSA-2024-12187.html
- https://bugzilla.suse.com/show_bug.cgi?id=1212649
- https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.9
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=63e44bc52047f182601e7817da969a105aa1f721
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a37cd2a59d0cb270b1bba568fd3a3b8668b9d3ba
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b9cb9c45583b911e0db71d09caa6b56469eb2bdf
- https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html