Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2026-12316

Опубликовано: 31 июл. 2023
Источник: fstec
CVSS3: 7.1
CVSS2: 6.5
EPSS Низкий

Описание

Уязвимость функций save_state(), rollback_state(), rxe_requester() модуля drivers/infiniband/sw/rxe/rxe_req.c драйвера InfiniBand ядра операционной системы Linux связана с нарушением соглашения о формате данных. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации

Вендор

Canonical Ltd.
Red Hat, Inc.
Сообщество свободного программного обеспечения

Наименование ПО

Ubuntu
Red Hat Enterprise Linux
Debian GNU/Linux
Linux

Версия ПО

16.04 LTS (Ubuntu)
18.04 LTS (Ubuntu)
8 (Red Hat Enterprise Linux)
20.04 LTS (Ubuntu)
12 (Debian GNU/Linux)
22.04 LTS (Ubuntu)
9 (Red Hat Enterprise Linux)
8.2 Advanced Update Support (Red Hat Enterprise Linux)
8.4 Advanced Mission Critical Update Support (Red Hat Enterprise Linux)
от 6.2 до 6.4.15 включительно (Linux)
9.0 Update Services for SAP Solutions (Red Hat Enterprise Linux)
8.6 Update Services for SAP Solutions (Red Hat Enterprise Linux)
8.6 Telecommunications Update Service (Red Hat Enterprise Linux)
8.6 Advanced Mission Critical Update Support (Red Hat Enterprise Linux)
7 Extended Lifecycle Support (Red Hat Enterprise Linux)
от 6.5 до 6.5.2 включительно (Linux)
8.8 Telecommunications Update Service (Red Hat Enterprise Linux)
8.8 Update Services for SAP Solutions (Red Hat Enterprise Linux)
9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux)
8.4 Extended Update Support Long-Life Add-On (Red Hat Enterprise Linux)
от 4.8 до 6.1.52 включительно (Linux)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

Canonical Ltd. Ubuntu 16.04 LTS
Canonical Ltd. Ubuntu 18.04 LTS
Red Hat, Inc. Red Hat Enterprise Linux 8
Canonical Ltd. Ubuntu 20.04 LTS
Сообщество свободного программного обеспечения Debian GNU/Linux 12
Canonical Ltd. Ubuntu 22.04 LTS
Red Hat, Inc. Red Hat Enterprise Linux 9
Red Hat, Inc. Red Hat Enterprise Linux 8.2 Advanced Update Support
Red Hat, Inc. Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Сообщество свободного программного обеспечения Linux от 6.2 до 6.4.15 включительно
Red Hat, Inc. Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Red Hat, Inc. Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
Red Hat, Inc. Red Hat Enterprise Linux 8.6 Telecommunications Update Service
Red Hat, Inc. Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Red Hat, Inc. Red Hat Enterprise Linux 7 Extended Lifecycle Support
Сообщество свободного программного обеспечения Linux от 6.5 до 6.5.2 включительно
Red Hat, Inc. Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Red Hat, Inc. Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Red Hat, Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Red Hat, Inc. Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Сообщество свободного программного обеспечения Linux от 4.8 до 6.1.52 включительно

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 6,5)
Высокий уровень опасности (базовая оценка CVSS 3.1 составляет 7,1)

Возможные меры по устранению уязвимости

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года.
Использование рекомендаций:
Для Linux:
https://git.kernel.org/stable/c/255c0e60e1d16874fc151358d94bc8df661600dd
https://git.kernel.org/stable/c/70518f3aaf5a059b691867d7d2d46b999319656a
https://git.kernel.org/stable/c/2f2a6422287fe29f9343247d77b645100ece0652
https://git.kernel.org/linus/5d122db2ff80cd2aed4dcd630befb56b51ddf947
Для Debian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2023-53539
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/CVE-2023-53539
Для Ubuntu:
https://ubuntu.com/security/CVE-2023-53539

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

EPSS

Процентиль: 5%
0.00154
Низкий

7.1 High

CVSS3

6.5 Medium

CVSS2

Связанные уязвимости

CVSS3: 7.8
ubuntu
12 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix incomplete state save in rxe_requester If a send packet is dropped by the IP layer in rxe_requester() the call to rxe_xmit_packet() can fail with err == -EAGAIN. To recover, the state of the wqe is restored to the state before the packet was sent so it can be resent. However, the routines that save and restore the state miss a significnt part of the variable state in the wqe, the dma struct which is used to process through the sge table. And, the state is not saved before the packet is built which modifies the dma struct. Under heavy stress testing with many QPs on a fast node sending large messages to a slow node dropped packets are observed and the resent packets are corrupted because the dma struct was not restored. This patch fixes this behavior and allows the test cases to succeed.

CVSS3: 5.5
redhat
12 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix incomplete state save in rxe_requester If a send packet is dropped by the IP layer in rxe_requester() the call to rxe_xmit_packet() can fail with err == -EAGAIN. To recover, the state of the wqe is restored to the state before the packet was sent so it can be resent. However, the routines that save and restore the state miss a significnt part of the variable state in the wqe, the dma struct which is used to process through the sge table. And, the state is not saved before the packet is built which modifies the dma struct. Under heavy stress testing with many QPs on a fast node sending large messages to a slow node dropped packets are observed and the resent packets are corrupted because the dma struct was not restored. This patch fixes this behavior and allows the test cases to succeed.

CVSS3: 7.8
nvd
12 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix incomplete state save in rxe_requester If a send packet is dropped by the IP layer in rxe_requester() the call to rxe_xmit_packet() can fail with err == -EAGAIN. To recover, the state of the wqe is restored to the state before the packet was sent so it can be resent. However, the routines that save and restore the state miss a significnt part of the variable state in the wqe, the dma struct which is used to process through the sge table. And, the state is not saved before the packet is built which modifies the dma struct. Under heavy stress testing with many QPs on a fast node sending large messages to a slow node dropped packets are observed and the resent packets are corrupted because the dma struct was not restored. This patch fixes this behavior and allows the test cases to succeed.

CVSS3: 7.8
debian
12 месяцев назад

In the Linux kernel, the following vulnerability has been resolved: R ...

CVSS3: 5.5
redos
19 дней назад

Уязвимость kernel-lt

EPSS

Процентиль: 5%
0.00154
Низкий

7.1 High

CVSS3

6.5 Medium

CVSS2