PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›CVE-2023-6931

CVE-2023-6931

kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size

Loading…

Severity

Moderate

Red Hat Product Security

7

CVSS 3.1

Review impact separately from score.

Published · November 29, 2023

Updated · August 7, 2026

Description

A flaw was found in the Linux kernel's Performance Events system component. A condition can be triggered that allows data to be written past the end or before the beginning of the intended memory buffer. This may lead to a system crash, code execution, or local privilege escalation.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

It is not possible to trigger this issue with the default kernel.perf_event_paranoid sysctl value 2. You may check it with: cat /proc/sys/kernel/perf_event_paranoid

CVSS / CWE

CVSS 3.1 · 7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 · Out-of-bounds Write