CVE-2023-2007 — Time-of-check Time-of-use (TOCTOU) Race Condition in Kernel
Severity
7.8HIGHNVD
EPSS
0.0%
top 92.30%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 24
Latest updateApr 25
Description
The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages4 packages
Also affects: Debian Linux 10.0, 11.0
Patches
🔴Vulnerability Details
2📋Vendor Advisories
3Microsoft▶
The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction w↗2023-04-11
Debian▶
CVE-2023-2007: linux - The specific flaw exists within the DPT I2O Controller driver. The issue results...↗2023