GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-54060 (GCVE-0-2023-54060)

Vulnerability from cvelistv5 – Published: 2025-12-24 12:23 – Updated: 2026-08-05 09:16
VLAI
Title
iommufd: Set end correctly when doing batch carry
Summary
In the Linux kernel, the following vulnerability has been resolved: iommufd: Set end correctly when doing batch carry Even though the test suite covers this it somehow became obscured that this wasn't working. The test iommufd_ioas.mock_domain.access_domain_destory would blow up rarely. end should be set to 1 because this just pushed an item, the carry, to the pfns list. Sometimes the test would blow up with: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP CPU: 5 PID: 584 Comm: iommufd Not tainted 6.5.0-rc1-dirty #1236 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:batch_unpin+0xa2/0x100 [iommufd] Code: 17 48 81 fe ff ff 07 00 77 70 48 8b 15 b7 be 97 e2 48 85 d2 74 14 48 8b 14 fa 48 85 d2 74 0b 40 0f b6 f6 48 c1 e6 04 48 01 f2 <48> 8b 3a 48 c1 e0 06 89 ca 48 89 de 48 83 e7 f0 48 01 c7 e8 96 dc RSP: 0018:ffffc90001677a58 EFLAGS: 00010246 RAX: 00007f7e2646f000 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 00000000fefc4c8d RDI: 0000000000fefc4c RBP: ffffc90001677a80 R08: 0000000000000048 R09: 0000000000000200 R10: 0000000000030b98 R11: ffffffff81f3bb40 R12: 0000000000000001 R13: ffff888101f75800 R14: ffffc90001677ad0 R15: 00000000000001fe FS: 00007f9323679740(0000) GS:ffff8881ba540000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000105ede003 CR4: 00000000003706a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? show_regs+0x5c/0x70 ? __die+0x1f/0x60 ? page_fault_oops+0x15d/0x440 ? lock_release+0xbc/0x240 ? exc_page_fault+0x4a4/0x970 ? asm_exc_page_fault+0x27/0x30 ? batch_unpin+0xa2/0x100 [iommufd] ? batch_unpin+0xba/0x100 [iommufd] __iopt_area_unfill_domain+0x198/0x430 [iommufd] ? __mutex_lock+0x8c/0xb80 ? __mutex_lock+0x6aa/0xb80 ? xa_erase+0x28/0x30 ? iopt_table_remove_domain+0x162/0x320 [iommufd] ? lock_release+0xbc/0x240 iopt_area_unfill_domain+0xd/0x10 [iommufd] iopt_table_remove_domain+0x195/0x320 [iommufd] iommufd_hw_pagetable_destroy+0xb3/0x110 [iommufd] iommufd_object_destroy_user+0x8e/0xf0 [iommufd] iommufd_device_detach+0xc5/0x140 [iommufd] iommufd_selftest_destroy+0x1f/0x70 [iommufd] iommufd_object_destroy_user+0x8e/0xf0 [iommufd] iommufd_destroy+0x3a/0x50 [iommufd] iommufd_fops_ioctl+0xfb/0x170 [iommufd] __x64_sys_ioctl+0x40d/0x9a0 do_syscall_64+0x3c/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f394576eb11dbcd3a740fa41e577b97f0720d26e , < 176f36a376c417b58d19f79edfce20db9317eaa2 (git)
Affected: f394576eb11dbcd3a740fa41e577b97f0720d26e , < b7c822fa6b7701b17e139f1c562fc24135880ed4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.4.8 , ≤ 6.4.* (semver)
Unaffected: 6.5 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/pages.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "176f36a376c417b58d19f79edfce20db9317eaa2",
              "status": "affected",
              "version": "f394576eb11dbcd3a740fa41e577b97f0720d26e",
              "versionType": "git"
            },
            {
              "lessThan": "b7c822fa6b7701b17e139f1c562fc24135880ed4",
              "status": "affected",
              "version": "f394576eb11dbcd3a740fa41e577b97f0720d26e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/iommu/iommufd/pages.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.8",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Set end correctly when doing batch carry\n\nEven though the test suite covers this it somehow became obscured that\nthis wasn\u0027t working.\n\nThe test iommufd_ioas.mock_domain.access_domain_destory would blow up\nrarely.\n\nend should be set to 1 because this just pushed an item, the carry, to the\npfns list.\n\nSometimes the test would blow up with:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: 0000 [#1] SMP\n  CPU: 5 PID: 584 Comm: iommufd Not tainted 6.5.0-rc1-dirty #1236\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n  RIP: 0010:batch_unpin+0xa2/0x100 [iommufd]\n  Code: 17 48 81 fe ff ff 07 00 77 70 48 8b 15 b7 be 97 e2 48 85 d2 74 14 48 8b 14 fa 48 85 d2 74 0b 40 0f b6 f6 48 c1 e6 04 48 01 f2 \u003c48\u003e 8b 3a 48 c1 e0 06 89 ca 48 89 de 48 83 e7 f0 48 01 c7 e8 96 dc\n  RSP: 0018:ffffc90001677a58 EFLAGS: 00010246\n  RAX: 00007f7e2646f000 RBX: 0000000000000000 RCX: 0000000000000001\n  RDX: 0000000000000000 RSI: 00000000fefc4c8d RDI: 0000000000fefc4c\n  RBP: ffffc90001677a80 R08: 0000000000000048 R09: 0000000000000200\n  R10: 0000000000030b98 R11: ffffffff81f3bb40 R12: 0000000000000001\n  R13: ffff888101f75800 R14: ffffc90001677ad0 R15: 00000000000001fe\n  FS:  00007f9323679740(0000) GS:ffff8881ba540000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000000000000000 CR3: 0000000105ede003 CR4: 00000000003706a0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  Call Trace:\n   \u003cTASK\u003e\n   ? show_regs+0x5c/0x70\n   ? __die+0x1f/0x60\n   ? page_fault_oops+0x15d/0x440\n   ? lock_release+0xbc/0x240\n   ? exc_page_fault+0x4a4/0x970\n   ? asm_exc_page_fault+0x27/0x30\n   ? batch_unpin+0xa2/0x100 [iommufd]\n   ? batch_unpin+0xba/0x100 [iommufd]\n   __iopt_area_unfill_domain+0x198/0x430 [iommufd]\n   ? __mutex_lock+0x8c/0xb80\n   ? __mutex_lock+0x6aa/0xb80\n   ? xa_erase+0x28/0x30\n   ? iopt_table_remove_domain+0x162/0x320 [iommufd]\n   ? lock_release+0xbc/0x240\n   iopt_area_unfill_domain+0xd/0x10 [iommufd]\n   iopt_table_remove_domain+0x195/0x320 [iommufd]\n   iommufd_hw_pagetable_destroy+0xb3/0x110 [iommufd]\n   iommufd_object_destroy_user+0x8e/0xf0 [iommufd]\n   iommufd_device_detach+0xc5/0x140 [iommufd]\n   iommufd_selftest_destroy+0x1f/0x70 [iommufd]\n   iommufd_object_destroy_user+0x8e/0xf0 [iommufd]\n   iommufd_destroy+0x3a/0x50 [iommufd]\n   iommufd_fops_ioctl+0xfb/0x170 [iommufd]\n   __x64_sys_ioctl+0x40d/0x9a0\n   do_syscall_64+0x3c/0x80\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through ioctls on the /dev/iommu (or /dev/vfio/vfio compat) character device \u2014 IOMMU_IOAS_MAP/COPY/UNMAP and object destroy paths, as shown by the `__x64_sys_ioctl -\u003e iommufd_fops_ioctl` call trace. No network or physical access is involved.\nAC:L - The attacker fully controls every precondition: hugepage-backed source memory for the contiguous PFN run, the overlapping area layout via IOMMU_IOAS_COPY, and the exact unmap offset that lands the hole/used boundary mid-run. Once the layout is arranged the `end=0` desynchronization and the resulting over-walk in batch_unpin() are deterministic; only the severity of the resulting garbage varies.\nPR:L - iommufd_fops_open() and the ioctl dispatcher perform no capability check whatsoever \u2014 access is gated only by permissions on /dev/iommu, which are routinely granted to unprivileged service accounts (qemu/libvirt for device passthrough, DPDK/SPDK users). An unprivileged local user with that device access can drive the entire path.\nUI:N - The full sequence \u2014 map, copy, attach, unmap/destroy \u2014 is performed by the attacker\u0027s own process with no victim action required.\nS:C - This breaks the invariant the code explicitly documents (\"For security we must not unpin something that is still DMA mapped\"): pages still mapped into a live IOMMU domain get their refcount dropped, so they can be freed and reallocated while an assigned device \u2014 programmed by a guest VM or by VFIO userspace \u2014 retains DMA access to them. That is an IOMMU/DMA boundary bypass reaching resources beyond iommufd\u0027s security authority.\nC:H - batch_unpin() walks past `end` with no bound check, reading adjacent kernel stack (the on-stack `u64 backup[32]` array) as PFNs, and the resulting refcount underflow frees pages that remain IOMMU-mapped and are then reallocated to arbitrary consumers \u2014 giving a device or attacker read access to reused kernel/user memory.\nI:H - The over-walk performs unpin_user_page_range_dirty_lock() and set_page_dirty on attacker-influenced wild struct page pointers, yielding an arbitrary refcount-decrement primitive plus premature page free (use-after-free) \u2014 a well-known route to heap grooming, arbitrary write and privilege escalation. The inflated index also drives iommu_unmap() over IOVA ranges beyond the intended area.\nA:H - The commit message documents a reproducible NULL pointer dereference oops in batch_unpin+0xa2 during iommufd_hw_pagetable_destroy, on a non-failable destroy path that holds pages-\u003emutex, so the crash also wedges other iommufd users. Any use-after-free from the refcount underflow crashes the kernel as well."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:49.139Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/176f36a376c417b58d19f79edfce20db9317eaa2"
        },
        {
          "url": "https://git.kernel.org/stable/c/b7c822fa6b7701b17e139f1c562fc24135880ed4"
        }
      ],
      "title": "iommufd: Set end correctly when doing batch carry",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54060",
    "datePublished": "2025-12-24T12:23:07.276Z",
    "dateReserved": "2025-12-24T12:21:05.091Z",
    "dateUpdated": "2026-08-05T09:16:49.139Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54060",
      "date": "2026-09-15",
      "epss": "0.00179",
      "percentile": "0.07624"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-54060\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-24T13:16:07.790\",\"lastModified\":\"2026-08-04T10:19:26.690\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niommufd: Set end correctly when doing batch carry\\n\\nEven though the test suite covers this it somehow became obscured that\\nthis wasn\u0027t working.\\n\\nThe test iommufd_ioas.mock_domain.access_domain_destory would blow up\\nrarely.\\n\\nend should be set to 1 because this just pushed an item, the carry, to the\\npfns list.\\n\\nSometimes the test would blow up with:\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000000\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 0 P4D 0\\n  Oops: 0000 [#1] SMP\\n  CPU: 5 PID: 584 Comm: iommufd Not tainted 6.5.0-rc1-dirty #1236\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\n  RIP: 0010:batch_unpin+0xa2/0x100 [iommufd]\\n  Code: 17 48 81 fe ff ff 07 00 77 70 48 8b 15 b7 be 97 e2 48 85 d2 74 14 48 8b 14 fa 48 85 d2 74 0b 40 0f b6 f6 48 c1 e6 04 48 01 f2 \u003c48\u003e 8b 3a 48 c1 e0 06 89 ca 48 89 de 48 83 e7 f0 48 01 c7 e8 96 dc\\n  RSP: 0018:ffffc90001677a58 EFLAGS: 00010246\\n  RAX: 00007f7e2646f000 RBX: 0000000000000000 RCX: 0000000000000001\\n  RDX: 0000000000000000 RSI: 00000000fefc4c8d RDI: 0000000000fefc4c\\n  RBP: ffffc90001677a80 R08: 0000000000000048 R09: 0000000000000200\\n  R10: 0000000000030b98 R11: ffffffff81f3bb40 R12: 0000000000000001\\n  R13: ffff888101f75800 R14: ffffc90001677ad0 R15: 00000000000001fe\\n  FS:  00007f9323679740(0000) GS:ffff8881ba540000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 0000000000000000 CR3: 0000000105ede003 CR4: 00000000003706a0\\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n  Call Trace:\\n   \u003cTASK\u003e\\n   ? show_regs+0x5c/0x70\\n   ? __die+0x1f/0x60\\n   ? page_fault_oops+0x15d/0x440\\n   ? lock_release+0xbc/0x240\\n   ? exc_page_fault+0x4a4/0x970\\n   ? asm_exc_page_fault+0x27/0x30\\n   ? batch_unpin+0xa2/0x100 [iommufd]\\n   ? batch_unpin+0xba/0x100 [iommufd]\\n   __iopt_area_unfill_domain+0x198/0x430 [iommufd]\\n   ? __mutex_lock+0x8c/0xb80\\n   ? __mutex_lock+0x6aa/0xb80\\n   ? xa_erase+0x28/0x30\\n   ? iopt_table_remove_domain+0x162/0x320 [iommufd]\\n   ? lock_release+0xbc/0x240\\n   iopt_area_unfill_domain+0xd/0x10 [iommufd]\\n   iopt_table_remove_domain+0x195/0x320 [iommufd]\\n   iommufd_hw_pagetable_destroy+0xb3/0x110 [iommufd]\\n   iommufd_object_destroy_user+0x8e/0xf0 [iommufd]\\n   iommufd_device_detach+0xc5/0x140 [iommufd]\\n   iommufd_selftest_destroy+0x1f/0x70 [iommufd]\\n   iommufd_object_destroy_user+0x8e/0xf0 [iommufd]\\n   iommufd_destroy+0x3a/0x50 [iommufd]\\n   iommufd_fops_ioctl+0xfb/0x170 [iommufd]\\n   __x64_sys_ioctl+0x40d/0x9a0\\n   do_syscall_64+0x3c/0x80\\n   entry_SYSCALL_64_after_hwframe+0x46/0xb0\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/iommu/iommufd/pages.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f394576eb11dbcd3a740fa41e577b97f0720d26e\",\"lessThan\":\"176f36a376c417b58d19f79edfce20db9317eaa2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f394576eb11dbcd3a740fa41e577b97f0720d26e\",\"lessThan\":\"b7c822fa6b7701b17e139f1c562fc24135880ed4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/iommu/iommufd/pages.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.4.8\",\"lessThanOrEqual\":\"6.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.0,\"impactScore\":6.0}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/176f36a376c417b58d19f79edfce20db9317eaa2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b7c822fa6b7701b17e139f1c562fc24135880ed4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:14:14+00:00",
      "cve": "CVE-2023-54060",
      "id": "CVE-2023-54060",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "279",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iommufd: Set end correctly when doing batch carry",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54060.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:04:09Z",
      "cve": "CVE-2023-54060",
      "id": "CVE-2023-54060",
      "initial_release_date": "2025-12-25T00:56:35Z",
      "product_status:known_affected": "394",
      "product_status:known_not_affected": "457",
      "product_status:recommended": "241",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54060",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54060.json",
      "version": "32"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.