Read the docs
TI-2023-06639 Aliases CVE-2023-7258GHSA-2h39-83vm-vq42

Denial-of-Service in Gvisor

Priority LOW 28CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-400.

Summary

A denial of service exists in Gvisor Sandbox where a bug in reference counting code in mount point tracking could lead to a panic, making it possible for an attacker running as root and with permission to mount volumes to kill the sandbox. We recommend upgrading past commit 6a112c60a257dadac59962e0bc9e9b5aee70b5b6

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00165 5th percentileScored 2026-11-07
Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:google:gvisor:*:*:*:*:*:*:*:*before 20231204.0VulnerableGoogle
  • cpe:2.3:a:google:gvisor:*:*:*:*:*:*:*:* Versions before 20231204.0 Vulnerable ·Google

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-7258
  2. 2026-10-03 Alias added: GHSA-2h39-83vm-vq42

References

Patch 1

  • TI-2018-13698 pkg/sentry/kernel/shm/shm.go in Google gVisor before 2018-11-01 allows attackers to… CVSS 3.0CRITICAL 9.8
  • TI-2018-11721 Google gVisor before 2018-08-23, within the seccomp sandbox, permits access to the… CVSS 3.0MEDIUM 6.8
  • TI-2025-02373 Improper File Permission Handling in Google gVisor runsc CVSS 4.0MEDIUM 6.8
  • TI-2024-09825 Weaknesses in the generation of TCP/UDP source ports and some other header values in… CVSS 4.0MEDIUM 6.3
  • TI-2024-09306 Improved Seeding and Hashing In gVisor CVSS 4.0MEDIUM 6.3
  • TI-2018-14290 Google gVisor before 2018-08-22 reuses a pagetable in a different level with the… CVSS 3.0MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences