CVE-2022-23523 json
rust-vmm linux-loader vulnerable to Out-of-bounds Read
published 2022-12-12 3 y ago modified 2026-06-17 4 mo ago also GHSA-52h2-m2cf-9jh6 , EUVD-2022-7510
- cvss
- 4.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
In versions prior to 0.8.1, the linux-loader crate uses the offsets and sizes provided in the ELF headers to determine the offsets to read from. If those offsets point beyond the end of the file this could lead to Virtual Machine Monitors using the `linux-loader` crate entering an infinite loop if the ELF header of the kernel they are loading was modified in a malicious manner. This issue has been addressed in 0.8.1. The issue can be mitigated by ensuring that only trusted kernel images are loaded or by verifying that the headers do not point beyond the end of the file.
Patch / fix
- crates.io linux-loader 0.8.1
- linux-loader_project linux-loader 0.8.1
- github.com/rust-vmm/linux-loader@a44f152 commit
- github.com/rust-vmm/linux-loader#125 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.0 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 1.9 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | linux-loader | <0.8.1 |
0.8.1 |
Affected products
- rust-vmm linux-loader
Classification
References
-
github.com
/rust-vmm/linux-loader/pull/125
web, issue-tracking, patch, third-party-advisory
-
github.com
/rust-vmm/linux-loader/commit/a44f152da4f38c538ed492b1efa8515be2047db2
web
-
github.com
/rust-vmm/linux-loader/security/advisories/GHSA-52h2-m2cf-9jh6
web, issue-tracking, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-23523
advisory
-
github.com
/rust-vmm/linux-loader
package
Sources
- CVE List CVE-2022-23523
- GitHub Advisory GHSA-52h2-m2cf-9jh6
- NVD CVE-2022-23523
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.