CVE-2023-6121
Public on 2023-11-16
        Modified on 2025-08-06
        
      Description
            
              An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This flaw allows a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data to be printed (and potentially leaked) to the kernel ring buffer (dmesg).
            
          Severity
          
          See what this means
        CVSS v3 Base Score
          
          See breakdown
        Affected Packages
| Platform | Package | Release Date | Advisory | Status | 
|---|---|---|---|---|
| Amazon Linux 1 | kernel | Not Affected | ||
| Amazon Linux 2 - Core | kernel | No Fix Planned | ||
| Amazon Linux 2 - Kernel-5.10 Extra | kernel | 2024-01-09 | ALAS2KERNEL-5.10-2024-045 | Fixed | 
| Amazon Linux 2 - Kernel-5.15 Extra | kernel | 2024-01-09 | ALAS2KERNEL-5.15-2024-033 | Fixed | 
| Amazon Linux 2 - Kernel-5.4 Extra | kernel | 2024-01-09 | ALAS2KERNEL-5.4-2024-057 | Fixed | 
| Amazon Linux 2023 | kernel | Not Affected | 
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | 
| NVD | CVSSv3 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |