CVE-2023-52502

Katalog CVE

CVSS 8.8 · High EPSS 0,25%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada linux kernel. Skor CVSS 3.1 8.8 (High) menurut CNA.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear.

Rincian

Terbit di NVD

2 Maret 2024

Terakhir diubah

4 Agustus 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber CNA
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-416: Use After Free

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 14,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/31c07dffafce914c1d1543c135382a11ff058d93 patch
• https://git.kernel.org/stable/c/6ac22ecdaad2ecc662048f8c6b0ceb1ca0699ef9 patch
• https://git.kernel.org/stable/c/7adcf014bda16cdbf804af5c164d94d5d025db2d patch
• https://git.kernel.org/stable/c/d1af8a39cf839d93c8967fdd858f6bbdc3e4a15c patch
• https://git.kernel.org/stable/c/d888d3f70b0de32b4f51534175f039ddab15eef8 patch
• https://git.kernel.org/stable/c/e4f2611f07c87b3ddb57c4b9e8efcd1e330fc3dc patch
• https://git.kernel.org/stable/c/e863f5720a5680e50c4cecf12424d7cc31b3eb0a patch