CVE-2023-52612

What it actually does

Missing bounds check on req->dst size before copying from scomp_scratch->dst allows out-of-bounds write in the Linux kernel crypto scomp code, resulting in memory corruption.

Why it matters to the business

Local attackers on affected Linux systems can corrupt kernel memory, potentially leading to privilege escalation, system crashes, or denial of service; the bug has been public for over two years with minimal observed exploitation activity.

How an attack unfolds

An attacker with local access submits a specially crafted compression request to the scomp interface that exceeds the destination buffer size; the unchecked copy from the scratch buffer overwrites adjacent kernel memory, which can be leveraged for code execution or further privilege escalation.

How to fix it

Update the Linux kernel to a version containing commit 1142d65c5b881590962ad763f94505b6dd67d2fe or later; rebuild and reboot with the patched kernel; apply vendor-supplied updates for distributions tracking this fix.

How to confirm the fix worked

Verify the running kernel contains commit 1142d65c5b881590962ad763f94505b6dd67d2fe via git log or package version checks; attempt to reproduce the original buffer-size condition in a test environment to confirm the copy is now guarded.

Typical attack path

1. Obtain local shell access on a vulnerable Linux kernel
2. Load or trigger the scomp crypto compression path with oversized request parameters
3. Trigger the unchecked copy to corrupt kernel memory structures
4. Use resulting corruption to execute arbitrary code or elevate privileges

How to detect it

Review kernel logs and audit records for unusual crypto compression activity or crashes near scomp paths; examine process execution history for unexpected local compression calls; no public exploit artifacts are known.

What your security team should do

• Prioritize kernel updates on all Linux hosts to the fixed commit within standard patch windows
• Monitor upstream stable branches for backports and apply them promptly
• Restrict untrusted local code execution where possible until patches are deployed