CVE-2023-21492
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
Medium
Known exploited
- Severity
- 4.4 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 2.55%
- Chance of exploitation in the next 30 days. Higher than 85.06% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since May 19, 2023
- Weakness
- CWE-532 Insertion of Sensitive Information into Log File
- CWE-532 Insertion of Sensitive Information into Log File
- Fix
- None yet
- No fixed version published
Exploited in the wild. Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability (Samsung Mobile Devices). Required action: Apply updates per vendor instructions. Due for U.S. federal agencies by Jun 9, 2023.
Description
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 4.4
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
How to prevent it
- Architecture and Design, Implementation: Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
- Distribution: Remove debug log files before deploying the application into production.
- Operation: Protect log files against unauthorized read/write.
- Implementation: Adjust configurations appropriately when software is transitioned from a debug state to production.
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
How to prevent it
- Architecture and Design, Implementation: Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
- Distribution: Remove debug log files before deploying the application into production.
- Operation: Protect log files against unauthorized read/write.
- Implementation: Adjust configurations appropriately when software is transitioned from a debug state to production.
References
Advisories
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-j7qq-vr8c-xvw3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans | Medium | Same weakness, CWE-532 |
| EEF-CVE-2026-105963 Secret key base exposed in stack trace arguments on wrong-typed Plug.Crypto arguments | Not rated yet | Same weakness, CWE-532 |
| GHSA-4xvq-3m68-h444 Backstage has sensitive information exposure in scaffolder task logs | Medium | Same weakness, CWE-532 |
| GHSA-95p4-vv4g-jxxm Backstage may expose sensitive information in Scaffolder task failure events | Medium | Same weakness, CWE-532 |
| GHSA-mfvq-x7vr-rgqg Backstage: Secret-derived values may be exposed in scaffolder task logs | Medium | Same weakness, CWE-532 |
| GHSA-444v-8vxr-p36h OpenBao Agent Writes Secrets to Stdout | Low | Same weakness, CWE-532 |
| EEF-CVE-2026-82723 Actor record with password digest stored in AshAuthentication audit log entries | Not rated yet | Same weakness, CWE-532 |
| GHSA-8wmf-6v46-5gfg OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs | Low | Same weakness, CWE-532 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor