CVE-2023-4459
Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup
CVE-2023-4459: Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup. Not in the CISA KEV catalog. Medium advisory severity (CVSS 5.5, Red Hat).
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
CVE-2023-4459 at a glance
- CISA KEV
- Not listed (catalog checked )
- Highest advisory severity
- Medium
- CVSS base score
- 5.5 (Red Hat)
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H(Red Hat)
- Weakness
- CWE-476
- Fixed releases
- Red Hat: kernel-0:4.18.0-193.133.1.el8_2, kernel-rt-0:4.18.0-193.133.1.rt13.184.el8_2, kernel-0:4.18.0-305.125.1.el8_4, kernel-rt-0:4.18.0-305.125.1.rt7.201.el8_4, kernel-0:4.18.0-372.87.1.el8_6, kernel-0:5.14.0-70.93.2.el9_0 and 8 more in the advisory
- Vendor advisories
- 1 from Red Hat
- VulniPulse record
- Published
Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2023-4459; bulletin-wide values are not repeated here.
Is CVE-2023-4459 exploited?
No exploitation is reported in the sources VulniPulse tracks: CVE-2023-4459 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.
How do I fix CVE-2023-4459?
Upgrade to a fixed release named by the vendor:
- Red Hat: kernel-0:4.18.0-193.133.1.el8_2, kernel-rt-0:4.18.0-193.133.1.rt13.184.el8_2, kernel-0:4.18.0-305.125.1.el8_4, kernel-rt-0:4.18.0-305.125.1.rt7.201.el8_4, kernel-0:4.18.0-372.87.1.el8_6, kernel-0:5.14.0-70.93.2.el9_0
- In order to mitigate this issue, prevent the affected code from being loaded by blacklisting the kernel module "vmxnet3". For instructions relating to how to blacklist a kernel module refer to: ~~~ Exploiting this flaw will require CAP_NET_ADMIN access privilege in any user or network namespace. ~~~ (Red Hat)
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium5.5
Medium [CVE-2023-4459] Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup
CVE-2023-4459Source published Source updated
A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with normal user privilege to cause a denial of service due to a missing sanity check during cleanup. For the Red Hat Enterprise Linux 8.7 (and higher versions) the patch that resolves the problem already applied (so no need to update then). Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-476. Affected Red Hat products: Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.2 Telecommunications Update Service; Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 8.4 Advanced…
- Affected products in this advisory
- Red Hat Enterprise Linux 8.2 Advanced Update Support
- Red Hat Enterprise Linux 8.2 Telecommunications Update Service
- Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
8 more entries in the full advisory.
- Source-reported affected versions
- Affected-version details not available in this record.
- Source-reported fixed versions
- kernel-0:4.18.0-193.133.1.el8_2
- kernel-rt-0:4.18.0-193.133.1.rt13.184.el8_2
- kernel-0:4.18.0-305.125.1.el8_4
- kernel-rt-0:4.18.0-305.125.1.rt7.201.el8_4
10 more entries in the full advisory.
- Mitigation guidance
- In order to mitigate this issue, prevent the affected code from being loaded by blacklisting the kernel module "vmxnet3". For instructions relating to how to blacklist a kernel module refer to: https://access.redhat.com/solutions/41278 ~~~ Exploiting this flaw will require CAP_NET_ADMIN access privilege in any user or network namespace. ~~~
Browse the latest tracked CVEs or the CVEs listed in CISA KEV.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.