{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3anetapphci_baseboard_management_controllerh410c/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","cpe:2.3:a:netapp:hci_baseboard_management_controller:h300s:*:*:*:*:*:*:*","cpe:2.3:a:netapp:hci_baseboard_management_controller:h410c:*:*:*:*:*:*:*","cpe:2.3:a:netapp:hci_baseboard_management_controller:h410s:*:*:*:*:*:*:*","cpe:2.3:a:netapp:hci_baseboard_management_controller:h500s:*:*:*:*:*:*:*","cpe:2.3:a:netapp:hci_baseboard_management_controller:h700s:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2023-2598"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Linux Kernel (\u003c 6.3.2)"],"_cs_severities":["high"],"_cs_tags":["linux","kernel","privilege-escalation","cve"],"_cs_type":"advisory","_cs_vendors":["Linux Foundation"],"content_html":"\u003cp\u003eCVE-2023-2598 is a local privilege escalation vulnerability in the Linux kernel originating from a logic flaw in the \u003ccode\u003eio_uring_register_buffer\u003c/code\u003e function. The kernel incorrectly validates whether pages passed from user space belong to the same compound page, specifically when the same physical page is mapped into contiguous virtual addresses using \u003ccode\u003emmap\u003c/code\u003e. This mismatch allows for an out-of-bounds read/write condition, which can be exploited to modify a process's UID in kernel memory.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker allocates a physical memory page.\u003c/li\u003e\n\u003cli\u003eThe attacker uses \u003ccode\u003emmap\u003c/code\u003e to map the same physical page into multiple contiguous virtual addresses.\u003c/li\u003e\n\u003cli\u003eThe attacker initiates \u003ccode\u003eio_uring_register_buffer\u003c/code\u003e to register the buffer.\u003c/li\u003e\n\u003cli\u003eThe kernel fails to properly validate the compound page boundaries because the virtual address mapping tricks the \u003ccode\u003epage_folio()\u003c/code\u003e check.\u003c/li\u003e\n\u003cli\u003eThe kernel grants access to the buffer, treating it as a larger contiguous memory region than the physical allocation.\u003c/li\u003e\n\u003cli\u003eThe attacker uses the resulting out-of-bounds write primitive to target internal process structures (e.g., \u003ccode\u003ecred\u003c/code\u003e structures).\u003c/li\u003e\n\u003cli\u003eThe attacker modifies the \u003ccode\u003euid\u003c/code\u003e field to zero (root) to escalate privileges.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a local, low-privileged user to gain root privileges on the affected system. The vulnerability does not require complex address space layout randomization (ASLR) bypasses, as the exploit directly targets the credential structure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade the Linux kernel to version 6.3.2 or later to include the necessary checks in the \u003ccode\u003eio_uring\u003c/code\u003e subsystem.\u003c/li\u003e\n\u003cli\u003eIf an immediate kernel upgrade is not possible, restrict access to \u003ccode\u003eio_uring\u003c/code\u003e syscalls for non-privileged users via \u003ccode\u003esysctl\u003c/code\u003e settings (e.g., \u003ccode\u003ekernel.io_uring_disabled=2\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eConduct periodic auditing of local user activity for unusual \u003ccode\u003emmap\u003c/code\u003e and \u003ccode\u003eio_uring\u003c/code\u003e usage patterns in development or multi-tenant environments.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-29T05:59:56Z","date_published":"2026-10-29T05:59:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-linux-kernel-lpe-cve-2023-2598/","summary":"A privilege escalation vulnerability in the Linux kernel io_uring subsystem caused by incorrect compound page validation allows local attackers to achieve out-of-bounds memory access and modify process credentials.","title":"Linux Kernel: io_uring local privilege escalation (CVE-2023-2598)","url":"https://feed.craftedsignal.io/briefs/2026-10-linux-kernel-lpe-cve-2023-2598/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:netapp:hci_baseboard_management_controller:h410c:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}