CVE-2023-4273 - CVE House

Back to Database

Status published Medium CVE-2023-4273

Kernel: exfat: stack overflow in exfat_get_uniname_from_ext_entry

6 CVSS

Vulnerability Description

A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging to one file into a single long file name. Since the file name characters are copied into a stack variable, a local privileged attacker could use this flaw to overflow the kernel stack.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-4273

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Red Hat would like to thank Maxim Suhanov for reporting this issue.

References

More from Red Hat

View All →

Aap-gateway: improper path validation in gateway allows credential exfiltration

Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams

Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

Libsoup: improper handling of http vary header in libsoup caching

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Affected Vendor

Red Hat

View all reports →

Affected Software

Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8

Vulnerable Versions:

0:5.14.0-362.8.1.el9_3

Timeline

Official Publish: August 9th, 2023

Last Modified: November 14th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1055 Process Injection

Defense Evasion

T1105 Ingress Tool Transfer

Command and Control

T1485 Data Destruction