PatchaPalooza

CVE-2023-4004:

CVE-2023-4004 is a vulnerability, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.92% probability of exploitation activity in the next 30 days, higher than 60% of all scored vulnerabilities. Microsoft released the fix on 4 August 2023, outside Patch Tuesday. It affects 2 products in 1 product family (Mariner).

Key facts

CVE ID
CVE-2023-4004
Severity
High CVSS 7.8
Exploited in the wild
No
Publicly disclosed
No
Weakness
CWE-416
EPSS
0.92% (percentile 60%)
CISA KEV
Not listed
Released
Last updated
Patch Tuesday
August 2023 Patch Tuesday
Product families
Mariner

CVSS score and vector

Microsoft scores CVE-2023-4004 at 7.8 (temporal 7.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

MetricValue
Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh

Affected products (2)

Mariner

ProductSecurity updateTypeFixed buildRestart
CBL Mariner 2.0 x64kernelCBL-Mariner5.15.126.1-1
CBL Mariner 2.0 ARMkernelCBL-Mariner5.15.126.1-1

NIST NVD data

NVD status
Modified
NVD CVSS
7.8 (HIGH)
NVD weakness
CWE-416
Published to NVD
NVD last modified

Affected configurations (CPE)

ProductVulnerable versions
linux kernelfrom 5.6, before 5.10.188
linux kernelfrom 5.11, before 5.15.123
linux kernelfrom 5.16, before 6.1.42
linux kernelfrom 6.2, before 6.4.7
fedora 38all listed versions
enterprise linux 8.0all listed versions
enterprise linux 9.0all listed versions
h300sall listed versions
h410sall listed versions
h500sall listed versions
h700sall listed versions
debian linux 10.0all listed versions
debian linux 11.0all listed versions
debian linux 12.0all listed versions

References

Revision history

VersionDateDescription
1.0Information published.

Sources