CVE-2023-1872

Katalog CVE

CVSS 7.0 · High EPSS 0,29%

Kerentanan Use After Free pada linux kernel, debian linux. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

A use-after-free vulnerability in the Linux Kernel io_uring system can be exploited to achieve local privilege escalation. The io_file_get_fixed function lacks the presence of ctx->uring_lock which can lead to a Use-After-Free vulnerability due a race condition with fixed files getting unregistered. We recommend upgrading past commit da24142b1ef9fd5d36b76e36bab328a5b27523e8.

Rincian

Terbit di NVD

12 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=da24142b1ef9fd5d36b... mailing list · patch
• http://packetstormsecurity.com/files/173087/Kernel-Live-Patch-Security-Notice-LSN-0095-1.html advisory pihak ketiga · vdb entry
• https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20230601-0002/ advisory pihak ketiga
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=08681391b84da27133d... mailing list · product