VDB

UBUNTU-CVE-2023-0459

UBUNTU-CVE-2023-0459 PUBLISHED CVSS 5.699999809265137 MEDIUM

Record from OSV · Published April 20, 2023

Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend upgrading beyond commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
linux-azure-4.15Ubuntu:18.04:LTS4.15.0-1165.180
linux-gcp-4.15Ubuntu:18.04:LTS4.15.0-1150.166
linux-aws-fipsUbuntu:Pro:FIPS-updates:18.04:LTS4.15.0-2095.101
linux-ibm-5.4Ubuntu:18.04:LTS5.4.0-1049.54~18.04.1
linux-fipsUbuntu:Pro:FIPS-updates:18.04:LTS4.15.0-1111.122
linux-oem-6.0Ubuntu:22.04:LTS6.0.0-1019.19
linux-xilinx-zynqmpUbuntu:20.04:LTS5.4.0-1024.28
linux-hwe-5.19Ubuntu:22.04:LTS5.19.0-42.43~22.04.1
linux-nvidiaUbuntu:22.04:LTS5.15.0-1025.25
linux-ibmUbuntu:20.04:LTS5.4.0-1049.54
linux-azure-5.15Ubuntu:20.04:LTS5.15.0-1038.45~20.04.1
linux-realtimeUbuntu:Pro:Realtime:22.04:LTS5.15.0-1038.41

47 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 4.0
5.699999809265137
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected products

VendorProductVersions
Ubuntu:20.04:LTSlinux-hwe-5.135.13.0-23.23~20.04.2, 5.13.0-25.26~20.04.1, 5.13.0-27.29~20.04.1
Ubuntu:20.04:LTSlinux-gcp-5.115.11.0-1009.10~20.04.1, 5.11.0-1023.25~20.04.1, 5.11.0-1017.19~20.04.1
Ubuntu:20.04:LTSlinux-gcp-5.85.8.0-1039.41, 0, 5.8.0-1032.34~20.04.1
Ubuntu:18.04:LTSlinux-oracle-5.05.0.0-1009.14~18.04.1, 5.0.0-1008.13~18.04.1, 5.0.0-1007.12~18.04.1
Ubuntu:18.04:LTSlinux-azure-4.154.15.0-1153.168, 0, 4.15.0-1082.92
Ubuntu:18.04:LTSlinux-gcp-4.154.15.0-1083.94, 4.15.0-1080.90, 4.15.0-1078.88
Ubuntu:20.04:LTSlinux-oem-5.135.13.0-1019.23, 5.13.0-1017.21, 5.13.0-1014.18
Ubuntu:Pro:FIPS-updates:18.04:LTSlinux-aws-fips4.15.0-2082.88, 4.15.0-2094.100, 4.15.0-2093.99
Ubuntu:18.04:LTSlinux-ibm-5.45.4.0-1014.15~18.04.1, 5.4.0-1012.13~18.04.1, 5.4.0-1010.11~18.04.2
Ubuntu:Pro:FIPS-updates:18.04:LTSlinux-fips4.15.0-1085.94, 4.15.0-1084.93, 4.15.0-1083.92
Ubuntu:20.04:LTSlinux-oem-5.145.14.0-1032.35, 5.14.0-1029.32, 5.14.0-1059.67
Ubuntu:22.04:LTSlinux-oem-6.06.0.0-1013.13, 6.0.0-1012.12, 6.0.0-1011.11
Ubuntu:18.04:LTSlinux-gcp-5.35.3.0-1016.17~18.04.1, 5.3.0-1029.31~18.04.1, 5.3.0-1030.32~18.04.1
Ubuntu:Pro:FIPS:18.04:LTSlinux-azure-fips0, 4.15.0-1002.2
Ubuntu:20.04:LTSlinux-xilinx-zynqmp5.4.0-1022.26, 5.4.0-1021.25, 5.4.0-1020.24
Ubuntu:Pro:FIPS:20.04:LTSlinux-azure-fips0, 5.4.0-1022.22+fips1
Ubuntu:22.04:LTSlinux-hwe-5.195.19.0-38.39~22.04.1, 5.19.0-40.41~22.04.1, 5.19.0-41.42~22.04.1
Ubuntu:18.04:LTSlinux-hwe5.3.0-26.28~18.04.1, 5.0.0-35.38~18.04.1, 5.0.0-32.34~18.04.2
Ubuntu:20.04:LTSlinux-hwe-5.115.11.0-44.48~20.04.2, 5.11.0-43.47~20.04.2, 5.11.0-27.29~20.04.1
Ubuntu:18.04:LTSlinux-oem4.15.0-1036.41, 4.15.0-1103.114, 4.15.0-1102.113

…and 107 more

Timeline

  • Apr 20, 2023 CVE Published
  • Oct 31, 2026 Distribution Patch (20 in total, the first dated here)
  • Oct 31, 2026 Security Advisory (20 in total, the first dated here)

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln UBUNTU-CVE-2023-0459
vulnetix vdb fixes UBUNTU-CVE-2023-0459

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/UBUNTU-CVE-2023-0459/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 4 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›