CVE-2023-6560: 
Linux Kernel vulnerability analysis and mitigation

An out-of-bounds memory access vulnerability (CVE-2023-6560) was discovered in the io_uring SQ/CQ rings functionality in the Linux kernel. The vulnerability was discovered by Jann Horn and disclosed in December 2023. This flaw affects Linux kernel versions up to 6.6 and various Linux distributions including Fedora, Ubuntu, and Red Hat (NVD, Ubuntu).

The vulnerability stems from incorrect behavior in the __io_uaddr_map function when handling non-physically contiguous memory. The function only checks if the first and last pages are the same, rather than verifying if all mapped pages are contiguous. This implementation flaw could lead to out-of-bounds memory access (Kernel Patch, Debian).

The vulnerability allows a local user to crash the system through a denial of service attack. The CVSS v3.1 base score is 5.5 (Medium), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating local access required and high impact on availability (NVD).

The vulnerability has been fixed in Linux kernel version 6.7-rc5. Various Linux distributions have released patches for their affected versions. For example, Ubuntu has fixed the issue in version 6.5.0-25.25 for Ubuntu 23.10, and Fedora has released kernel version 6.6.6 containing the fix (Ubuntu, Fedora).