CVE-2023-52556 - Vulnerability Details - OpenCVE

ReportizFlow

In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/009_pf.patch.sig
https://github.com/openbsd/src/commit/9d9f4dc6c833cb79d13f836581e3a781d06842e7

History

Thu, 14 Nov 2024 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: cisa-cg

Published: 2024-03-01T16:08:49.203Z

Updated: 2024-11-14T19:47:00.394Z

Reserved: 2024-03-01T16:04:51.307Z

Link: CVE-2023-52556

Vulnrichment

Updated: 2024-08-02T23:03:20.916Z

NVD

Status : Awaiting Analysis

Published: 2024-03-01T17:15:07.177

Modified: 2024-11-21T08:40:03.070

Link: CVE-2023-52556

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-52556", "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725", "state": "PUBLISHED", "assignerShortName": "cisa-cg", "dateReserved": "2024-03-01T16:04:51.307Z", "datePublished": "2024-03-01T16:08:49.203Z", "dateUpdated": "2024-11-14T19:47:00.394Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "OpenBSD", "repo": "https://github.com/openbsd/src/", "vendor": "OpenBSD", "versions": [{"lessThan": "7.4 errata 009", "status": "affected", "version": "7.4", "versionType": "custom"}]}], "datePublic": "2023-12-10T00:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic.</span><br>"}], "value": "In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic.\n"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9119a7d8-5eab-497f-8521-727c672e3725", "shortName": "cisa-cg", "dateUpdated": "2024-03-01T16:24:46.415Z"}, "references": [{"url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/009_pf.patch.sig"}, {"url": "https://github.com/openbsd/src/commit/9d9f4dc6c833cb79d13f836581e3a781d06842e7"}], "source": {"discovery": "UNKNOWN"}, "title": "OpenBSD 7.4 pf state race condition kernel crash", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-03-01T20:48:41.991088Z", "id": "CVE-2023-52556", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-14T19:47:00.394Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:20.916Z"}, "title": "CVE Program Container", "references": [{"url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/009_pf.patch.sig", "tags": ["x_transferred"]}, {"url": "https://github.com/openbsd/src/commit/9d9f4dc6c833cb79d13f836581e3a781d06842e7", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/009_pf.patch.sig", "tags": ["x_transferred"]}, {"url": "https://github.com/openbsd/src/commit/9d9f4dc6c833cb79d13f836581e3a781d06842e7", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:03:20.916Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-52556", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-01T20:48:41.991088Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T15:20:41.218Z"}}], "cna": {"title": "OpenBSD 7.4 pf state race condition kernel crash", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/openbsd/src/", "vendor": "OpenBSD", "product": "OpenBSD", "versions": [{"status": "affected", "version": "7.4", "lessThan": "7.4 errata 009", "versionType": "custom"}], "defaultStatus": "affected"}], "datePublic": "2023-12-10T00:00:00.000Z", "references": [{"url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/009_pf.patch.sig"}, {"url": "https://github.com/openbsd/src/commit/9d9f4dc6c833cb79d13f836581e3a781d06842e7"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic.\n", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition"}]}], "providerMetadata": {"orgId": "9119a7d8-5eab-497f-8521-727c672e3725", "shortName": "cisa-cg", "dateUpdated": "2024-03-01T16:24:46.415Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52556", "state": "PUBLISHED", "dateUpdated": "2024-11-14T19:47:00.394Z", "dateReserved": "2024-03-01T16:04:51.307Z", "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725", "datePublished": "2024-03-01T16:08:49.203Z", "assignerShortName": "cisa-cg"}, "dataVersion": "5.1"}