CVE-2023-1076
CVSS v3.1
5.5 (Medium)
EPSS
0.04 % (17th)
Affected Products
1
Advisories
26
A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters.
Weaknesses
- CWE-791
- Incomplete Filtering of Special Elements
- CWE-843
- Access of Resource Using Incompatible Type ('Type Confusion')
Related CVEs
- CVE Status
- PUBLISHED
- CNA
- Red Hat, Inc.
- Published Date
-
2023-03-27 21:15:10
(17 months ago) - Updated Date
-
2023-05-03 01:15:10
(16 months ago)
Affected Products
Loading...
Loading...
Configuration #1
|
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...