NetSight
IP …
medium5.5

CVE-2023-4194

A flaw was found in the Linux kernel's TUN/TAP functionality.

Impact

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
through 6.4
Version 6.5
RedhatEnterprise Linux
Versions 8.0, 9.0
FedoraprojectFedora
Versions 37, 38
DebianDebian Linux
Versions 10.0, 11.0, 12.0

Weakness classification

CWE-843CWE-863

References