CVE-2023-23039 — Race Condition in Kernel

CWE-362 — Race ConditionCWE-416 — Use After Free7 documents7 sources
Severity
5.7MEDIUMNVD
EPSS
0.0%
top 93.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Linux KernelDebian LinuxMsrc Cbl2 Kernel 5.15.135.1-2 ON CBL Mariner 2.0+1 more
Timeline
PublishedFeb 22
Latest updateAug 19

Description

An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling open(), aka a race condition between vcc_open() and vcc_remove().

CVSS vector

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:HExploitability: 0.5 | Impact: 5.2

Affected Packages4 packages

▶NVDlinux/linux_kernel< 6.2.0+1
▶debiandebian/linux

Patches

Patch: lkml.org ↗Patch: lkml.org ↗

🔴Vulnerability Details

2
OSV
CVE-2023-23039: An issue was discovered in the Linux kernel through 6↗2023-02-22
▶
GHSA
GHSA-hr7h-xh5g-347q: An issue was discovered in the Linux kernel through 6↗2023-02-22
▶

📋Vendor Advisories

3
Red Hat
kernel: tty: vcc: race condition leading to use-after-free in vcc_open()↗2023-02-22
▶
Microsoft
An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c has a race condition and resultant use-after-free if a physically proximate attacker removes a VCC device while calling↗2023-02-14
▶
Debian
CVE-2023-23039: linux - An issue was discovered in the Linux kernel through 6.2.0-rc2. drivers/tty/vcc.c...↗2023
▶

📄Research Papers

1
arXiv
Top of the Heap: Efficient Memory Error Protection of Safe Heap Objects↗2024-08-19
▶