CVE-2023-52974

Katalog CVE

CVSS 7.8 · High EPSS 0,29%

Kerentanan Use After Free pada linux kernel. Skor CVSS 3.1 7.8 (High) menurut CISA ADP.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress If during iscsi_sw_tcp_session_create() iscsi_tcp_r2tpool_alloc() fails, userspace could be accessing the host's ipaddress attr. If we then free the session via iscsi_session_teardown() while userspace is still accessing the session we will hit a use after free bug. Set the tcp_sw_host->session after we have completed session creation and can no longer fail.

Rincian

Terbit di NVD

27 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber CISA ADP
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 20,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/0aaabdb900c7415caa2006ef580322f7eac5f6b6 patch
• https://git.kernel.org/stable/c/496af9d3682ed4c28fb734342a09e6cc0c056ea4 patch
• https://git.kernel.org/stable/c/61e43ebfd243bcbad11be26bd921723027b77441 patch
• https://git.kernel.org/stable/c/6abd4698f4c8a78e7bbfc421205c060c199554a0 patch
• https://git.kernel.org/stable/c/9758ffe1c07b86aefd7ca8e40d9a461293427ca0 patch
• https://git.kernel.org/stable/c/d4d765f4761f9e3a2d62992f825aeee593bcb6b9 patch
• https://git.kernel.org/stable/c/f484a794e4ee2a9ce61f52a78e810ac45f3fe3b3 patch