« Volver al listado

CVE-2023-54139

Estado: AplazadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

tracing/user_events: Ensure write index cannot be negative

The write index indicates which event the data is for and accesses a per-file array. The index is passed by user processes during write() calls as the first 4 bytes. Ensure that it cannot be negative by returning -EINVAL to prevent out of bounds accesses.

Update ftrace self-test to ensure this occurs properly.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L + PR:L sin UI justifica T1068. La falta de validación del índice permite lectura/corrupción de memoria local (C:H, I:H) y potencial DoS por acceso fuera de límites.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramFilter Network TrafficExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-54139",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7f5a08c79df35e68f1a43033450c5050f12bc155",
              "lessThan": "0489c2b2c3104b89f078dbcec8c744dfc157d3e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7f5a08c79df35e68f1a43033450c5050f12bc155",
              "lessThan": "4fe46b5adf18e3dc606e62c9e6a0413398a17572",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7f5a08c79df35e68f1a43033450c5050f12bc155",
              "lessThan": "fa7f2f5d1739452280c22727c4384a52b72ab5de",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "7f5a08c79df35e68f1a43033450c5050f12bc155",
              "lessThan": "cd98c93286a30cc4588dfd02453bec63c2f4acf4",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "kernel/trace/trace_events_user.c",
            "tools/testing/selftests/user_events/ftrace_test.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.28",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.2.15",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.*"
            },
            {
              "status": "unaffected",
              "version": "6.3.2",
              "versionType": "semver",
              "lessThanOrEqual": "6.3.*"
            },
            {
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "kernel/trace/trace_events_user.c",
            "tools/testing/selftests/user_events/ftrace_test.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-24T13:16:15.900",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0489c2b2c3104b89f078dbcec8c744dfc157d3e9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4fe46b5adf18e3dc606e62c9e6a0413398a17572",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cd98c93286a30cc4588dfd02453bec63c2f4acf4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fa7f2f5d1739452280c22727c4384a52b72ab5de",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/user_events: Ensure write index cannot be negative\n\nThe write index indicates which event the data is for and accesses a\nper-file array. The index is passed by user processes during write()\ncalls as the first 4 bytes. Ensure that it cannot be negative by\nreturning -EINVAL to prevent out of bounds accesses.\n\nUpdate ftrace self-test to ensure this occurs properly."
    }
  ],
  "lastModified": "2026-08-04T10:19:31.110",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}