CVE-2023-7258 - Denial-of-Service in Gvisor

Back Back to CVE browser

MEDIUM

Denial-of-Service in Gvisor

Published May 15, 2024

6.5

MEDIUM

CVSS 3.1

EPSS 0.17%

Description

A denial of service exists in Gvisor Sandbox where a bug in reference counting code in mount point tracking could lead to a panic, making it possible for an attacker running as root and with permission to mount volumes to kill the sandbox. We recommend upgrading past commit 6a112c60a257dadac59962e0bc9e9b5aee70b5b6

Affected products

Vendor Google Product Gvisor Default
unaffected
Affected
- ≥ , <

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Google	Gvisor	unaffected	Affected ≥ , <

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-59652		Advisory
https://github.com/google/gvisor/commit/6a112c60a257dadac59962e0bc9e9b5aee70b5b6		Patch

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Google

Published May 15, 2024

Updated Aug 2, 2024

Reserved May 2, 2024

Link CVE-2023-7258

CISA Vulnrichment

Updated May 15, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2023-7258

Red Hat

No data

ENISA EUVD

Assigner Google

Published May 15, 2024

Updated Aug 2, 2024

Link EUVD-2023-59652

GitHub

No data