VDB

UBUNTU-CVE-2023-0458

UBUNTU-CVE-2023-0458 PUBLISHED CVSS 2 LOW

Record from OSV · Published April 26, 2023

A speculative pointer dereference problem exists in the Linux Kernel on the do_prlimit() function. The resource argument value is controlled and is used in pointer arithmetic for the 'rlim' variable and can be used to leak the contents. We recommend upgrading past version 6.1.8 or commit 739790605705ddcf18f21782b9c99ad7d53a8c11

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
linux-hwe-5.4Ubuntu:18.04:LTS5.4.0-147.164~18.04.1
linux-oracleUbuntu:Pro:16.04:LTS4.15.0-1117.128~16.04.1
linux-azureUbuntu:22.04:LTS5.15.0-1036.43
linux-gkeUbuntu:20.04:LTS5.4.0-1097.104
linux-oracleUbuntu:20.04:LTS5.4.0-1099.108
linux-azure-fipsUbuntu:Pro:FIPS-updates:18.04:LTS4.15.0-2072.78
linux-iotUbuntu:20.04:LTS5.4.0-1017.18
linux-ibmUbuntu:20.04:LTS5.4.0-1047.52
linux-oem-6.1Ubuntu:22.04:LTS6.1.0-1008.8
linux-azure-4.15Ubuntu:18.04:LTS4.15.0-1163.178
linuxUbuntu:20.04:LTS5.4.0-147.164
linux-ibm-5.4Ubuntu:18.04:LTS5.4.0-1047.52~18.04.1

47 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0
2
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

VendorProductVersions
Ubuntu:20.04:LTSlinux-oem-5.135.13.0-1028.35, 5.13.0-1026.32, 5.13.0-1022.26
Ubuntu:18.04:LTSlinux-hwe-5.45.4.0-74.83~18.04.1, 5.4.0-77.86~18.04.1, 5.4.0-80.90~18.04.1
Ubuntu:Pro:16.04:LTSlinux-oracle4.15.0-1018.20~16.04.1, 4.15.0-1116.127~16.04.1, 4.15.0-1115.126~16.04.1
Ubuntu:22.04:LTSlinux-azure5.15.0-1001.2, 5.15.0-1002.3, 5.15.0-1003.4
Ubuntu:20.04:LTSlinux-gke5.4.0-1087.94, 5.4.0-1090.97, 5.4.0-1091.98
Ubuntu:20.04:LTSlinux-oracle5.4.0-1062.66, 5.4.0-1009.9, 5.4.0-1011.11
Ubuntu:Pro:FIPS-updates:18.04:LTSlinux-azure-fips4.15.0-2037.41, 4.15.0-2070.76, 4.15.0-2068.74
Ubuntu:20.04:LTSlinux-iot5.4.0-1014.16, 5.4.0-1013.15, 5.4.0-1012.14
Ubuntu:20.04:LTSlinux-ibm5.4.0-1004.5, 5.4.0-1014.15, 5.4.0-1013.14
Ubuntu:20.04:LTSlinux-hwe-5.115.11.0-27.29~20.04.1, 5.11.0-22.23~20.04.1, 0
Ubuntu:22.04:LTSlinux-oem-6.16.1.0-1004.4, 0, 6.1.0-1006.6
Ubuntu:20.04:LTSlinux-aws-5.80, 5.8.0-1038.40~20.04.1, 5.8.0-1042.44~20.04.1
Ubuntu:18.04:LTSlinux-azure-4.154.15.0-1110.122, 4.15.0-1109.121, 4.15.0-1108.120
Ubuntu:20.04:LTSlinux5.4.0-125.141, 0, 5.3.0-18.19
Ubuntu:18.04:LTSlinux-oem0, 4.15.0-1103.114, 4.15.0-1102.113
Ubuntu:18.04:LTSlinux-ibm-5.45.4.0-1036.41~18.04.1, 5.4.0-1029.33~18.04.1, 5.4.0-1028.32~18.04.1
Ubuntu:20.04:LTSlinux-intel-5.135.13.0-1010.10, 5.13.0-1011.11, 5.13.0-1014.15
Ubuntu:18.04:LTSlinux-snapdragon4.15.0-1144.154, 4.15.0-1145.155, 4.15.0-1146.156
Ubuntu:20.04:LTSlinux-xilinx-zynqmp0, 5.4.0-1021.25, 5.4.0-1023.27
Ubuntu:Pro:FIPS-updates:20.04:LTSlinux-gcp-fips5.4.0-1086.94+fips1, 5.4.0-1081.88+fips1, 5.4.0-1080.87+fips1

…and 118 more

Timeline

  • Apr 26, 2023 CVE Published
  • Oct 31, 2026 Distribution Patch (10 in total, the first dated here)
  • Oct 31, 2026 Security Advisory (10 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln UBUNTU-CVE-2023-0458
vulnetix vdb fixes UBUNTU-CVE-2023-0458

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/UBUNTU-CVE-2023-0458/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›