CVE-2023-21264

What it actually does

Misplaced memory access check in mem_protect.c allows access to hypervisor memory from code running with system privileges.

Why it matters to the business

Attackers who already have high-level system access could read or tamper with protected hypervisor memory, increasing risk of full system compromise on affected devices.

How an attack unfolds

An attacker with system execution privileges supplies crafted inputs that trigger the incorrectly placed memory check, bypassing intended protections and reading or writing hypervisor memory directly.

How to fix it

Update affected Wireshark packages on Ubuntu 14.04 LTS to version 1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.1 or later.

How to confirm the fix worked

Verify the installed package version matches or exceeds the fixed release and confirm the vulnerable mem_protect.c functions are no longer present after the update.

Typical attack path

1. Obtain system-level execution on the target device
2. Invoke one of the affected functions in mem_protect.c with malicious parameters
3. Trigger the misplaced check to gain unauthorized hypervisor memory access
4. Escalate privileges or extract sensitive data from hypervisor memory

How to detect it

Search system and application logs for unexpected calls into memory-protection routines and monitor for privilege-escalation events originating from processes with system-level rights.

What your security team should do

• Apply the listed fixed package versions immediately on all Ubuntu 14.04 LTS systems running Wireshark
• Remove or isolate any remaining Ubuntu 14.04 LTS instances that cannot be updated
• Review system logs for any prior anomalous memory access attempts related to hypervisor interfaces