CVE-2023-50431 is an information leak vulnerability affecting the Linux kernel through version 6.6.5, specifically within the Habanalabs accelerator driver. The flaw stems from an uninitialized padding field (info->pad0) in the sec_attest_info structure, which can expose sensitive kernel memory to user space. With a CVSS score of 5.5 (Medium), this local vulnerability requires low privileges and complexity to exploit, potentially leading to high confidentiality impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 6.3, < 6.8CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c in the Linux kernel through 6.6.5 allows an information leak to user space because info->pad0 is not initialized.
Dec 12, 2023kernel: information leak in sec_attest_info
Nov 22, 2023