A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.
| Version | Score | Severity | Vector String |
|---|---|---|---|
| 3.1 | 5.5 | Medium | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| Product | Vendor | Version |
|---|---|---|
| Red Hat Enterprise Linux 8 | Red Hat | < 19.2R1-S4, 19.2R2 |
| Red Hat Enterprise Linux 9 | Red Hat | < https://aka.ms/OfficeSecurityReleases |
| Red Hat Enterprise Linux 6 | Red Hat | < 18.3R2-S4, 18.3R3 |
| Red Hat Enterprise Linux 7 | Red Hat | 6.0.5 |
| Red Hat Enterprise Linux 9 | Red Hat | 1.0 |
| Red Hat Enterprise Linux 7 | Red Hat | < 19.1R2 |
| Red Hat Enterprise Linux 8 | Red Hat | <= 3.3.1 |
| Red Hat Enterprise Linux 9 | Red Hat | n/a |
| Red Hat Virtualization 4 | Red Hat | <= 0.0.3 |