CVE-2023-1513

Note

restricted info leak, only available to kvm group
WRT the break commit, there are two ways to look at this
CVE: to consider it covering that the commit 97e69aa62f8b "KVM:
x86: fix information leak to userland" (v2.6.37-rc2) incompletely
fixed the information disclosure, or that it covers the information
disclosure in its entirety. We have chosen to interpret it as
the former here, as more than debugregs leaks were attempted to
be covered by commit 97e69aa62f8b. This is despite the fact that
it does not appear that a CVE was issued for the original kernel
memory disclosure issue. If the interpretation is the latter, then
the break commit would be a1efbe77c1fd "KVM: x86: Add support for
saving&restoring debug registers" (v2.6.35-rc1).

Parameter	Value
Base score	3.3
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	None
Availability impact	None
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVE-2023-1513

From the Ubuntu Security Team

Notes

Priority

Cvss 3 Severity Score

Status

Severity score breakdown

References

Bugs

Join the discussion

Canonical is offering Expanded Security Maintenance

Further reading

Package	Release	Status
linux Launchpad, Ubuntu, Debian	bionic	Released (4.15.0-211.222)
	focal	Released (5.4.0-149.166)
	jammy	Released (5.15.0-72.79)
	kinetic	Released (5.19.0-42.43)
	lunar	Not vulnerable (6.2.0-18.18)
	mantic	Not vulnerable (6.2.0-20.20)
	noble	Not vulnerable (6.5.0-9.9)
	trusty	Ignored (ESM criteria, was needed)
	upstream	Released (6.2, 5.4.232, 5.15.95)
	xenial	Ignored (ESM criteria, was needed)
	Patches: Introduced by 97e69aa62f8b5d338d6cff49be09e37cc1262838 Fixed by 2c10b61421a28e95a46ab489fd56c0f442ff6952
linux-allwinner Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Not vulnerable
	lunar	Not vulnerable
	mantic	Does not exist
	noble	Does not exist
	trusty	Does not exist
	upstream	Ignored (end of life, was needs-triage)
	xenial	Does not exist
linux-allwinner-5.19 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Not vulnerable
	kinetic	Does not exist
	lunar	Does not exist
	mantic	Does not exist
	noble	Does not exist
	trusty	Does not exist
	upstream	Ignored (end of life, was needs-triage)
	xenial	Does not exist
linux-aws Launchpad, Ubuntu, Debian	bionic	Released (4.15.0-1156.169)
	focal	Released (5.4.0-1102.110)
	jammy	Released (5.15.0-1036.40)
	kinetic	Released (5.19.0-1025.26)
	lunar	Not vulnerable (6.2.0-1002.2)
	mantic	Not vulnerable (6.2.0-1003.3)
	noble	Not vulnerable (6.5.0-1008.8)
	trusty	Ignored (ESM criteria, was needed)
	upstream	Released (6.2, 5.4.232, 5.15.95)