[Git][security-tracker-team/security-tracker][master] CVE-2023-42465

[Bastien Roucariès (@rouca)]

Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b5542d69 by Bastien Roucariès at 2024-01-21T16:41:40+00:00
CVE-2023-42465

Add information about this hardening patch

Moreover only a few part are relevant for debian due to using PAM

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -5185,8 +5185,13 @@ CVE-2023-42465 (Sudo before 1.9.15 might allow row hammer attacks (for authentic
 	- sudo 1.9.15p2-2
 	[bookworm] - sudo <no-dsa> (Minor issue)
 	[bullseye] - sudo <no-dsa> (Minor issue)
+	[buster] - sudo <no-dsa> (Minor issue)
 	NOTE: https://www.openwall.com/lists/oss-security/2023/12/21/9
 	NOTE: https://github.com/sudo-project/sudo/commit/7873f8334c8d31031f8cfa83bd97ac6029309e4f (SUDO_1_9_15p1)
+	NOTE: it is more an hardening against hardware bug (rowhammer) than a security fix per se
+	NOTE: part of the code in the fix commit are not built because debian use PAM: plugins/sudoers/auth/sudo_auth.[ch]
+	NOTE: plugins/sudoers/lookup.c part was added in version 1.9.15
+	NOTE: plugins/sudoers/match.c, part was added in 1.8.21
 CVE-2023-7047 (Inadequate validation of permissions when employing remote tools and   ...)
 	NOT-FOR-US: Devolutions
 CVE-2023-7042 (A null pointer dereference vulnerability was found in ath10k_wmi_tlv_o ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b5542d6949246c804483ef72d1d148be52715f83

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b5542d6949246c804483ef72d1d148be52715f83
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240121/34a35348/attachment.htm>