CVE-2023-1032
published 2024-01-08CVE-2023-1032: The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.27%
19.3th percentile
The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | linux | < linux 6.1.20-1 (bookworm) | linux 6.1.20-1 (bookworm) |
| github.com | russellhaering_gosaml2 | >= 0 < 0.9.0 | 0.9.0 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 0 < 6.1.20-1 | 6.1.20-1 |
| linux | linux_kernel | >= 5.13.0 < 5.15.113 | 5.15.113 |
| linux | linux_kernel | >= 5.16.0 < 6.1.30 | 6.1.30 |
| linux | linux_kernel | >= 5.19 < 6.3 | 6.3 |
| linux | linux_kernel | >= 6.2.0 < 6.3.4 | 6.3.4 |
| the_linux_kernel_organization | linux | < 6.3~rc2 | 6.3~rc2 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv8.8HIGH
vendor_ubuntu7.8HIGH
vendor_redhat5.3MEDIUM
vendor_debian4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: serial: 8250_bcm7271: fix leak in `brcmuart_probe`
vendor_redhat·2025-12-30·CVSS 3.3
CVE-2023-54301 [LOW] CWE-772 kernel: serial: 8250_bcm7271: fix leak in `brcmuart_probe`
kernel: serial: 8250_bcm7271: fix leak in `brcmuart_probe`
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250_bcm7271: fix leak in `brcmuart_probe`
Smatch reports:
drivers/tty/serial/8250/8250_bcm7271.c:1120 brcmuart_probe() warn:
'baud_mux_clk' from clk_prepare_enable() not released on lines: 1032.
The issue is fixed by using a managed clock.
A resource leak flaw was found in the Broadcom BCM7271 serial driver. In the brcmuart_probe() function, the baud_mux_clk clock is prepared and enabled but not released in error paths, causing a clock resource leak when driver probe fails.
Statement: This affects only Broadcom BCM7271 platforms using the 8250_bcm7271 serial driver. The leak occurs only during failed probe operations, not during normal runtime. Standard
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2023-04-19·CVSS 7.8
CVE-2023-0468 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Traffic-Control Index (TCINDEX) implementation
in the Linux kernel contained a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-1281)
Lin Ma discovered a race condition in the io_uring subsystem in the Linux
kernel, leading to a null pointer dereference vulnerability. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2023-0468)
It was discovered that a use-after-free vulnerability existed in the SGI
GRU driver in the Linux kernel. A local attacker could possibly use this to
cause a denial of service (system crash) or possibly e
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2023-04-19·CVSS 5.5
CVE-2023-1076 [MEDIUM] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Traffic-Control Index (TCINDEX) implementation
in the Linux kernel did not properly perform filter deactivation in some
situations. A local attacker could possibly use this to gain elevated
privileges. Please note that with the fix for this CVE, kernel support for
the TCINDEX classifier has been removed. (CVE-2023-1829)
William Zhao discovered that the Traffic Control (TC) subsystem in the
Linux kernel did not properly handle network packet retransmission in
certain situations. A local attacker could use this to cause a denial of
service (kernel deadlock). (CVE-2022-4269)
Thadeu Cascardo discovered that the io_uring subsystem contained a double-
free vul
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2023-03-27·CVSS 5.8
CVE-2022-2196 [MEDIUM] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Traffic-Control Index (TCINDEX) implementation
in the Linux kernel contained a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-1281)
It was discovered that the KVM VMX implementation in the Linux kernel did
not properly handle indirect branch prediction isolation between L1 and L2
VMs. An attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2022-2196)
Thadeu Cascardo discovered that the io_uring subsystem contained a double-
free vulnerability in certain memory allocation error conditions. A lo
Red Hat
kernel: io_uring IORING_OP_SOCKET double free
vendor_redhat·2023-03-13·CVSS 4.7
CVE-2023-1032 [MEDIUM] kernel: io_uring IORING_OP_SOCKET double free
kernel: io_uring IORING_OP_SOCKET double free
The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067.
A double-free vulnerability was found in handling the IORING_OP_SOCKET operation with io_uring in the Linux kernel. This issue requires a memory allocation failure to happen, which is followed by a double-free of a recently allocated object.
Statement: No shipped kernel versions were seen affected with this problem.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not
Red Hat
gosaml2: Denial of service via `deflate`-compressed request
vendor_redhat·2023-03-04·CVSS 5.3
CVE-2023-26483 [MEDIUM] CWE-409 gosaml2: Denial of service via `deflate`-compressed request
gosaml2: Denial of service via `deflate`-compressed request
gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of Service attacks. A bug in this library enables attackers to craft a `deflate`-compressed request which will consume significantly more memory during processing than the size of the original request. This may eventually lead to memory exhaustion and the process being killed. The maximum compression ratio achievable with `deflate` is 1032:1, so by limiting the size of bodies passed to gosaml2, limiting the rate and concurrency of calls, and ensuring that lots of memory is available to the process it _may_ be possible to help Go's garbage collector "keep up". Implementors are
Debian
CVE-2023-1032: linux - The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in ...
vendor_debian·2023·CVSS 4.7
CVE-2023-1032 [MEDIUM] CVE-2023-1032: linux - The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in ...
The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067.
Scope: local
bookworm: resolved (fixed in 6.1.20-1)
bullseye: resolved
forky: resolved (fixed in 6.1.20-1)
sid: resolved (fixed in 6.1.20-1)
trixie: resolved (fixed in 6.1.20-1)
OSV
serial: 8250_bcm7271: fix leak in `brcmuart_probe`
osv·2025-12-30
CVE-2023-54301 serial: 8250_bcm7271: fix leak in `brcmuart_probe`
serial: 8250_bcm7271: fix leak in `brcmuart_probe`
In the Linux kernel, the following vulnerability has been resolved:
serial: 8250_bcm7271: fix leak in `brcmuart_probe`
Smatch reports:
drivers/tty/serial/8250/8250_bcm7271.c:1120 brcmuart_probe() warn:
'baud_mux_clk' from clk_prepare_enable() not released on lines: 1032.
The issue is fixed by using a managed clock.
GHSA
GHSA-5f35-x73c-jq69: The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket
ghsa_unreviewed·2024-01-08
CVE-2023-1032 [MEDIUM] CWE-415 GHSA-5f35-x73c-jq69: The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket
The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067.
OSV
CVE-2023-1032: The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket
osv·2024-01-08·CVSS 5.5
CVE-2023-1032 [MEDIUM] CVE-2023-1032: The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket
The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067.
OSV
linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.19, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi vulnerabilities
osv·2023-04-19·CVSS 7.8
CVE-2023-1281 [HIGH] linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.19, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi vulnerabilities
linux, linux-aws, linux-azure, linux-gcp, linux-hwe-5.19, linux-kvm, linux-lowlatency, linux-oracle, linux-raspi vulnerabilities
It was discovered that the Traffic-Control Index (TCINDEX) implementation
in the Linux kernel contained a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-1281)
Lin Ma discovered a race condition in the io_uring subsystem in the Linux
kernel, leading to a null pointer dereference vulnerability. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2023-0468)
It was discovered that a use-after-free vulnerability existed in the SGI
GRU driver in the Linux kernel. A local attacker could possibly use this to
cause a denial of service (
OSV
linux-oem-6.1 vulnerabilities
osv·2023-04-19·CVSS 5.5
CVE-2023-1829 [MEDIUM] linux-oem-6.1 vulnerabilities
linux-oem-6.1 vulnerabilities
It was discovered that the Traffic-Control Index (TCINDEX) implementation
in the Linux kernel did not properly perform filter deactivation in some
situations. A local attacker could possibly use this to gain elevated
privileges. Please note that with the fix for this CVE, kernel support for
the TCINDEX classifier has been removed. (CVE-2023-1829)
William Zhao discovered that the Traffic Control (TC) subsystem in the
Linux kernel did not properly handle network packet retransmission in
certain situations. A local attacker could use this to cause a denial of
service (kernel deadlock). (CVE-2022-4269)
Thadeu Cascardo discovered that the io_uring subsystem contained a double-
free vulnerability in certain memory allocation error conditions. A local
attacker cou
OSV
linux-oem-6.0 vulnerabilities
osv·2023-03-27·CVSS 8.8
CVE-2023-1281 [HIGH] linux-oem-6.0 vulnerabilities
linux-oem-6.0 vulnerabilities
It was discovered that the Traffic-Control Index (TCINDEX) implementation
in the Linux kernel contained a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-1281)
It was discovered that the KVM VMX implementation in the Linux kernel did
not properly handle indirect branch prediction isolation between L1 and L2
VMs. An attacker in a guest VM could use this to expose sensitive
information from the host OS or other guest VMs. (CVE-2022-2196)
Thadeu Cascardo discovered that the io_uring subsystem contained a double-
free vulnerability in certain memory allocation error conditions. A local
attacker could possibly use this to cause a denial of service (system
cras
GHSA
gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb
ghsa·2023-03-02
CVE-2023-26483 [MEDIUM] CWE-409 gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb
gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb
### Impact
SAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of Service attacks. A bug in this library enables attackers to craft a `deflate`-compressed request which will consume significantly more memory during processing than the size of the original request. This may eventually lead to memory exhaustion and the process being killed.
### Mitigation
The maximum compression ratio achievable with `deflate` is 1032:1, so by limiting the size of bodies passed to gosaml2, limiting the rate and concurrency of calls, and ensuring that lots of memory is available to the process it _may_ be possible to help Go's garbage collector "keep up".
Implementors are encouraged
No detection rules found.
No public exploits indexed.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1032https://ubuntu.com/security/notices/USN-5977-1https://ubuntu.com/security/notices/USN-6024-1https://ubuntu.com/security/notices/USN-6033-1https://www.openwall.com/lists/oss-security/2023/03/13/2https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1032https://ubuntu.com/security/notices/USN-5977-1https://ubuntu.com/security/notices/USN-6024-1https://ubuntu.com/security/notices/USN-6033-1https://www.openwall.com/lists/oss-security/2023/03/13/2
2024-01-08
Published