CVE-2023-0160
published 2023-07-18CVE-2023-0160: A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.29%
21.1th percentile
A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.85-1 (bookworm) | linux 6.1.85-1 (bookworm) |
| fedoraproject | fedora | — | — |
| linux | linux_kernel | < 6.4 | 6.4 |
| linux | linux_kernel | >= 0 < 5.10.216-1 | 5.10.216-1 |
| linux | linux_kernel | >= 0 < 6.1.85-1 | 6.1.85-1 |
| linux | linux_kernel | >= 0 < 6.8.9-1 | 6.8.9-1 |
| linux | linux_kernel | >= 0 < 6.8.9-1 | 6.8.9-1 |
| msrc | cbl2_kernel_5.15.131.1-2_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens TIM 1531 IRC
cisa_ics·2024-06-13·CVSS 5.5
[MEDIUM] Siemens TIM 1531 IRC
ICS Advisory
##
Siemens TIM 1531 IRC
Release DateJune 13, 2024
Alert CodeICSA-24-165-06
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 6.9
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIPLUS TIM 1531 IRC
- Vulnerabilities: Improper Input Validation, Out-of-bounds Write, Inadequate Encryption Strength, Double Free, Missing
CISA ICS
Siemens SCALANCE XCM-/XRM-300
cisa_ics·2024-02-15
Siemens SCALANCE XCM-/XRM-300
ICS Advisory
##
Siemens SCALANCE XCM-/XRM-300
Release DateFebruary 15, 2024
Alert CodeICSA-24-046-11
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 9.8
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SCALANCE XCM-/XRM-300
- Vulnerabilities: Out-of-bounds Write, Incorrect Type Conversion or Cast, Improper Verification of Cryptographic Signature, Improper Access Control, Improper Authentication, Missing Encryption
Microsoft
Possibility of deadlock in libbpf function sock_hash_delete_elem
vendor_msrc·2023-07-11·CVSS 5.5
CVE-2023-0160 [MEDIUM] CWE-667 Possibility of deadlock in libbpf function sock_hash_delete_elem
Possibility of deadlock in libbpf function sock_hash_delete_elem
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: ht
Red Hat
kernel: possibility of deadlock in libbpf function sock_hash_delete_elem
vendor_redhat·2023-03-12·CVSS 4.7
CVE-2023-0160 [MEDIUM] CWE-833 kernel: possibility of deadlock in libbpf function sock_hash_delete_elem
kernel: possibility of deadlock in libbpf function sock_hash_delete_elem
A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.
A deadlock flaw was found in the Linux kernel’s BPF subsystem. The fail happens in the function sock_hash_delete_elem.
This flaw allows a local user to potentially crash the system.
Mitigation: The default Red Hat Enterprise Linux kernel prevents unprivileged users from being able to use eBPF by the kernel.unprivileged_bpf_disabled sysctl.
This would require a privileged user with CAP_SYS_ADMIN or root to be able to abuse this flaw reducing its attack space.
For the Red Hat Enterprise Linux 7 the eBPF for unprivileged users is always disabled.
For the Red Hat Enterprise Linux 8 or 9 to confi
Debian
CVE-2023-0160: linux - A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows ...
vendor_debian·2023·CVSS 4.7
CVE-2023-0160 [MEDIUM] CVE-2023-0160: linux - A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows ...
A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.
Scope: local
bookworm: resolved (fixed in 6.1.85-1)
bullseye: resolved (fixed in 5.10.216-1)
forky: resolved (fixed in 6.8.9-1)
sid: resolved (fixed in 6.8.9-1)
trixie: resolved (fixed in 6.8.9-1)
OSV
CVE-2023-0160: A deadlock flaw was found in the Linux kernel’s BPF subsystem
osv·2023-07-18·CVSS 5.5
CVE-2023-0160 [MEDIUM] CVE-2023-0160: A deadlock flaw was found in the Linux kernel’s BPF subsystem
A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.
GHSA
GHSA-m24r-p59v-q652: A deadlock flaw was found in the Linux kernel’s BPF subsystem
ghsa_unreviewed·2023-07-18
CVE-2023-0160 [MEDIUM] CWE-667 GHSA-m24r-p59v-q652: A deadlock flaw was found in the Linux kernel’s BPF subsystem
A deadlock flaw was found in the Linux kernel’s BPF subsystem. This flaw allows a local user to potentially crash the system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/security/cve/CVE-2023-0160https://bugzilla.redhat.com/show_bug.cgi?id=2159764https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ed17aa92dc56https://lore.kernel.org/all/CABcoxUayum5oOqFMMqAeWuS8+EzojquSOSyDA3J_2omY=2EeAg@mail.gmail.com/https://access.redhat.com/security/cve/CVE-2023-0160https://bugzilla.redhat.com/show_bug.cgi?id=2159764https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ed17aa92dc56https://lore.kernel.org/all/CABcoxUayum5oOqFMMqAeWuS8+EzojquSOSyDA3J_2omY=2EeAg@mail.gmail.com/
2023-07-18
Published