{"id":"CVE-2023-7258","summary":"Denial-of-Service in Gvisor","details":"A denial of service exists in Gvisor Sandbox where a bug in reference counting code in mount point tracking could lead to a panic, making it possible for an attacker running as root and with permission to mount volumes to kill the sandbox. We recommend upgrading past commit 6a112c60a257dadac59962e0bc9e9b5aee70b5b6","modified":"2026-09-30T08:14:07.212835042Z","published":"2024-05-15T16:29:08.574Z","database_specific":{"cna_assigner":"Google","cwe_ids":["CWE-400"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/7xxx/CVE-2023-7258.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/7xxx/CVE-2023-7258.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-7258"},{"type":"FIX","url":"https://github.com/google/gvisor/commit/6a112c60a257dadac59962e0bc9e9b5aee70b5b6"},{"type":"PACKAGE","url":"https://github.com/google/gvisor"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/google/gvisor","events":[{"introduced":"0b983ff832b175e406f4f9b1a3868457bb1ceb7b"},{"fixed":"6a112c60a257dadac59962e0bc9e9b5aee70b5b6"}]}],"versions":["release-20231120.0","release-20231113.0","release-20231106.0","release-20231030.0","release-20231023.0","release-20231016.0","release-20231009.0","release-20231003.0","release-20230925.0","release-20230920.0","release-20230911.0","release-20230904.0","release-20230823.0","release-20230814.0","release-20230724.0","release-20230807.0","release-20230801.0","release-20230731.0","release-20230522.0","release-20230717.0","release-20230710.0","release-20230627.0","release-20230621.0","release-20230605.0","release-20230529.0","release-20230517.0","release-20230508.0","release-20230501.0","release-20230417.0","release-20230327.0","release-20230320.0","release-20230313.0","release-20230306.0","release-20230227.0","release-20230214.0","release-20230130.0","release-20230123.0","release-20230118.0","release-20230109.0","release-20230102.0","release-20221219.0","release-20221205.0","release-20221212.0","release-20221128.0","release-20221122.0","release-20221107.0","release-20221102.1","release-20221026.0"],"database_specific":{"vanir_signatures_modified":"2026-09-30T08:14:07Z","source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-7258.json","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/google/gvisor/commit/6a112c60a257dadac59962e0bc9e9b5aee70b5b6","target":{"file":"test/syscalls/linux/mount.cc"},"deprecated":false,"digest":{"line_hashes":["269802285469074608123542573705608135095","15643295923371110299552405570464642109","30707538532061579888770222677221965848","140833348707707780581757800415215888964","311327337334935848450225604739890492340","228271758042552947232133433063952989862","168102985027651801616458849826001019691","95541713137360941677230737423589630070","328970649726918352133359352452513874559","108587633537507210242609878158511307392"],"threshold":0.9},"id":"CVE-2023-7258-8c75cc02"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H"}]}