CVE-2023-6238CWE-120

Kernel: nvme: memory corruption via unprivileged user passthrough

Medium · published November 21, 2023

CVSS v3.1
6.7
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access (DMA) into the same buffer, overwriting unrelated kernel memory, causing random kernel crashes and memory corruption.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00290 · 20.5th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2023-11-21T20:21Z
EPSS history
Timeline
  • 21 NOV 20:21Z
    Kernel: nvme: memory corruption via unprivileged user passthrough
    cvelistv5