CVE-2023-26924

Published: 27 March 2023

** DISPUTED ** LLVM a0dab4950 has a segmentation fault in mlir::outlineSingleBlockRegion. NOTE: third parties dispute this because the LLVM security policy excludes "Language front-ends ... for which a malicious input file can cause undesirable behavior."

Notes

Author	Note
	Priority reason: This CVE was rejected
mdeslaur	This CVE will likely get rejected, see comment in upstream bug Marking as not-affected as the CVE was disputed

Priority

Cvss 3 Severity Score

5.5

Score breakdown

Status

Package	Release	Status
llvm Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Ignored (end of standard support)
	upstream	Needs triage
	xenial	Ignored (end of standard support)
llvm-toolchain-10 Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	focal	Not vulnerable
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
llvm-toolchain-11 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Not vulnerable
	jammy	Not vulnerable
	kinetic	Ignored (end of life, was not-affected)
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
llvm-toolchain-12 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Not vulnerable
	jammy	Not vulnerable
	kinetic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
llvm-toolchain-3.3 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Ignored (end of standard support)
	upstream	Needs triage
	xenial	Does not exist
llvm-toolchain-3.4 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Ignored (end of standard support)
	upstream	Needs triage
	xenial	Does not exist
llvm-toolchain-3.5 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Not vulnerable
llvm-toolchain-3.6 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Not vulnerable
	upstream	Needs triage
	xenial	Not vulnerable
llvm-toolchain-3.7 Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Not vulnerable
llvm-toolchain-3.8 Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Not vulnerable
	upstream	Needs triage
	xenial	Not vulnerable
llvm-toolchain-3.9 Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Not vulnerable
	upstream	Needs triage
	xenial	Not vulnerable
llvm-toolchain-4.0 Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Not vulnerable
llvm-toolchain-5.0 Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Not vulnerable
llvm-toolchain-6.0 Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	focal	Not vulnerable
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Not vulnerable
llvm-toolchain-7 Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	focal	Not vulnerable
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
llvm-toolchain-8 Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	focal	Not vulnerable
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Not vulnerable
llvm-toolchain-9 Launchpad, Ubuntu, Debian	bionic	Not vulnerable
	focal	Not vulnerable
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Does not exist
	upstream	Needs triage
	xenial	Does not exist
llvm-toolchain-snapshot Launchpad, Ubuntu, Debian	bionic	Does not exist
	focal	Does not exist
	jammy	Does not exist
	kinetic	Does not exist
	trusty	Ignored (end of standard support)
	upstream	Needs triage
	xenial	Does not exist

Severity score breakdown

Parameter	Value
Base score	5.5
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	None
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Bugs

https://github.com/llvm/llvm-project/issues/60216

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›