Linux Kernel
CVE-2023-2008
HIGH
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Local vector confirmed by device-access requirement; PR:H reflects udmabuf device privilege prerequisite; S:C captures user-to-kernel scope escalation with full CIA impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
AnalysisAI
Privilege escalation to kernel-level code execution is possible via the Linux kernel's udmabuf device driver, where the VM fault handler (udmabuf_vm_fault) directly indexes into a pages array using the user-influenced page offset vmf->pgoff without validating it against the allocated page count. This CWE-129 (improper array index validation) flaw allows a local attacker with high privileges to trigger an out-of-bounds memory access, enabling arbitrary kernel code execution. No public exploit or CISA KEV listing was identified at time of analysis; EPSS sits at 1.01% (59th percentile), and the upstream fix is confirmed via a torvalds/linux commit and multiple Red Hat RHSA errata.
Technical ContextAI
The udmabuf driver (drivers/dma-buf/udmabuf.c) implements a DMA buffer sharing mechanism that lets userspace create DMA buffers backed by memfd memory. Its fault handler udmabuf_vm_fault() is invoked on page faults for memory-mapped udmabuf regions. The root cause is CWE-129 (Improper Validation of Array Index): the handler used vmf->pgoff - a user-influenced page fault offset - directly to index into ubuf->pages[] without checking whether the offset was within the allocated page count (ubuf->pagecount). The upstream fix (commit 05b252cc) introduces a single bounds check: if (pgoff >= ubuf->pagecount) return VM_FAULT_SIGBUS;. Affected CPEs span multiple Linux kernel release series (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*), with explicit NVD entries covering kernel 5.19, 5.19-rc1, 5.19-rc2, and 5.19-rc3.
RemediationAI
Apply the upstream Linux kernel patch at commit 05b252cc (https://github.com/torvalds/linux/commit/05b252cccb2e5c3f56119d25de684b4f810ba4), which introduces bounds checking in udmabuf_vm_fault(). Red Hat Enterprise Linux users should apply the applicable errata - RHSA-2022:7933, RHSA-2022:8267, RHSA-2023:3465, RHSA-2023:3470, or RHSA-2023:3490 - depending on their installed RHEL version (https://access.redhat.com/security/cve/CVE-2023-2008). NetApp customers should consult https://security.netapp.com/advisory/ntap-20230517-0007/ for product-specific guidance. An exact fixed upstream kernel release version number is not independently confirmed from the available data beyond the commit reference. As a compensating control where immediate patching is not feasible, removing the udmabuf kernel module (modprobe -r udmabuf) or restricting /dev/udmabuf permissions via udev rules will prevent exploitation; the trade-off is disabling userspace DMA buffer sharing functionality, which may break applications (such as certain virtualization or GPU workloads) that depend on the udmabuf interface.
Same weakness CWE-129 – Improper Validation of Array Index
View allShare
External POC / Exploit Code
Leaving vuln.today