CVE-2023-1252

published 2023-03-23

CVE-2023-1252: A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage…

Priority P3 41 high 7.8 CVSS 3.1

AV L AC L PR L UI N S U C H I H A H

A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with the overlay FS usage. This flaw allows a local user to crash or potentially escalate their privileges on the system. Only if patch 9a2544037600 ("ovl: fix use after free in struct ovl_aio_req") not applied yet, the kernel could be affected.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 5.15.3-3 (bookworm)	linux 5.15.3-3 (bookworm)
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.84-1	5.10.84-1
linux	linux_kernel	>= 0 < 5.15.3-3	5.15.3-3
linux	linux_kernel	>= 0 < 5.15.3-3	5.15.3-3
linux	linux_kernel	>= 0 < 5.15.3-3	5.15.3-3
linux	linux_kernel	>= 5.11 < 5.14.19	5.14.19
linux	linux_kernel	>= 5.15 < 5.15.3	5.15.3
linux	linux_kernel	>= 5.6 < 5.10.80	5.10.80
msrc	cbl2_kernel_5.15.107.1-2_on_cbl_mariner_2.0	—	—
msrc	cbl_mariner_1.0_arm	—	—
msrc	cbl_mariner_1.0_x64	—	—
msrc	cbl_mariner_2.0_arm	—	—
msrc	cbl_mariner_2.0_x64	—	—
msrc	cm1_kernel_5.10.177.1-1_on_cbl_mariner_1.0	—	—

CVSS provenance

nvd v3.1 7.8 HIGH CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

osv 7.8 HIGH

vendor_debian 7.8 HIGH

vendor_msrc 7.8 HIGH

vendor_redhat 7.8 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-416