Skip to main content

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

© 2026 Mondoo, Inc.

Privacy Policy Terms of Service Imprint

Vulnerability Intelligence

Vulnerability IntelligenceCVE-2023-0459

CVE-2023-0459

MEDIUM6.5

Copy_from_user Spectre-V1 Gadget in Linux Kernel

Published May 25, 2023

Modified 1 years ago

Details

Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47

References

WEBhttps://github.com/torvalds/linux/commit/4b842e4e25b12951fa10dedb4bc16bc47e3b850c WEBhttps://github.com/torvalds/linux/commit/74e19ef0ff8061ef55957c3abd71614ef0f42f47 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2023-0459

CVSS Analysis

CVSS v3.1

6.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

6.5/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

Other

Ecosystems

Timeline

PublishedMay 25, 2023

ModifiedSep 26, 2024

CVE-2023-0459 | Mondoo Vulnerability Intelligence