CVE-2023-2194 is an out-of-bounds write vulnerability in the Linux kernel's SLIMpro I2C device driver, affecting various Fedora and Red Hat Enterprise Linux distributions. A local privileged user could exploit this flaw due to an uncapped userspace variable being used as a memcpy size, potentially leading to system crashes or arbitrary code execution. With a CVSS score of 6.7 (Medium), the attack requires local access and high privileges, but has high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 6.3CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
6.3CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:* | ||
6.3CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:* | ||
6.3CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.3:rc3:*:*:*:*:*:* | ||
38CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2023-2194
May 9, 2023An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution.
Apr 11, 2023kernel: i2c: out-of-bounds write in xgene_slimpro_i2c_xfer()
Mar 16, 2023