PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-6931 Siemens CVE debrief

CVE-2023-6931 is a high-severity Linux kernel vulnerability in the Performance Events subsystem. The issue can allow a local attacker with the necessary permissions context to trigger a heap out-of-bounds increment/write in perf_read_group(), creating a path to local privilege escalation. NVD lists the issue as affecting Linux kernel versions from 4.3 up to, but not including, 6.7, and also includes Debian Linux 10.0 in its affected CPE data.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2023-12-19
Original CVE updated
2026-08-17
Advisory published
2023-12-19
Advisory updated
2026-08-17

Who should care

Linux kernel maintainers, distribution security teams, fleet operators, and administrators responsible for servers, desktops, containers, or appliances that expose vulnerable kernel builds. Security teams should prioritize systems where untrusted local users, multi-tenant workloads, or developer access increase the value of local privilege escalation.

Technical summary

The vulnerability is described as a heap out-of-bounds write in the Linux kernel's Performance Events system. A perf_event read_size can overflow, which then leads to an out-of-bounds increment or write in perf_read_group(). NVD maps the weakness to CWE-787 and assigns CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating meaningful local impact once an attacker can reach the vulnerable code path. The supplied remediation pointer is kernel commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.

Defensive priority

High. The vulnerability is locally exploitable and can result in privilege escalation, so it should be treated as a priority kernel update for any affected fleet, especially multi-user or exposed systems.

Recommended defensive actions

  • Upgrade to a kernel build that includes commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.
  • Confirm whether your Linux kernel version falls within the affected range listed by NVD (4.3 through before 6.7) or matches any vendor-specific affected release.
  • Use vendor or distribution advisories, including the referenced Debian LTS notices, to identify the correct backported fix for your platform.
  • Prioritize patching systems with local user access, shared hosts, developer workstations, and multi-tenant environments.
  • After remediation, verify the running kernel build and document the fixed version in asset inventories and patch records.

Evidence notes

This debrief is based on the NVD CVE record and its embedded references. The vulnerability description states that a perf_event read_size overflow can cause an heap out-of-bounds increment/write in perf_read_group(). NVD lists CVSS 3.1 7.8 and CWE-787, and provides the fix reference to Linux kernel commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b. The CVE was published on 2023-12-19 and later modified on 2026-05-12. Debian LTS advisory links are present in the source corpus, but their contents were not provided here.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-6931 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-6931

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-6931 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-6931

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-226-15.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-613116.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-613116.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-15

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.