CVE-2023-1074

low-risk
Published 2023-03-27

A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a user starts a malicious networking service and someone connects to this service. This could allow a local user to starve resources, causing a denial of service.

Do I need to act?

-
0.01% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Affected Vendors

Linux

References (12)

http://www.openwall.com/lists/oss-security/2023/11/05/4
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2173430
Mailing List https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=4...
https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
Mailing List https://www.openwall.com/lists/oss-security/2023/01/23/1
http://www.openwall.com/lists/oss-security/2023/11/05/4
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2173430
Mailing List https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=4...
https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
Mailing List https://www.openwall.com/lists/oss-security/2023/01/23/1
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal