CVE-2023-6345
Memory Safety in Fedoraproject Fedora 37 … 39
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HSummary
CVE-2023-6345 is a critical-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Fedoraproject Fedora. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-6345 is an integer overflow vulnerability (CWE-190) in the Skia graphics library used by Google Chrome. It affected all versions prior to 119.0.6045.199 and carried a CVSS 3.1 score of 9.6.
A remote attacker who had already compromised the Chrome renderer process could supply a malicious file to trigger the flaw and potentially escape the sandbox, achieving elevated access on the host system.
The primary mitigation is the Stable Channel update published on 28 November 2023 that advances Chrome to 119.0.6045.199 or later; downstream Fedora advisories likewise distribute the patched builds.
The associated EPSS score rose materially from a low baseline to a peak of 0.2024 on 5 December 2024 before receding to its current value of 0.0129, indicating a period of increased exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-58586
Vulnerability Data
Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
- CWE(s)
- KEV Date Added
- 30 November 2023
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.2.6
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require use of safe arithmetic, bounds checks, and testing that prevent integer overflows.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect integer overflows before release.
Secure SDLC mandates input validation and arithmetic checks that prevent integer overflows.
Application security requirements include bounds checking and safe arithmetic to avoid overflow conditions.
Secure architecture principles require defensive coding patterns that mitigate integer wraparound risks.
Secure coding standards explicitly forbid unsafe integer operations and mandate overflow-safe constructs.