CVE-2023-2458
published 2023-05-12CVE-2023-2458: Use after free in ChromeOS Camera in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker who convinced a user to engage in specific UI…
PriorityP343high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.52%
41.0th percentile
Use after free in ChromeOS Camera in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via UI interaction. (Chromium security severity: High)
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chrome | < 113.0.5672.114 | 113.0.5672.114 | |
| chrome | >= 113.0.5672.114 < 113.0.5672.114 | 113.0.5672.114 | |
| chrome_chrome | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-49984 [MEDIUM] CWE-476 kernel: HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
kernel: HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
In the Linux kernel, the following vulnerability has been resolved:
HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report
It is possible for a malicious device to forgo submitting a Feature
Report. The HID Steam driver presently makes no prevision for this
and de-references the 'struct hid_report' pointer obtained from the
HID devices without first checking its validity. Let's change that.
A flaw was found in the hid-steam module in the Linux kernel. A NULL pointer dereference can be triggered when a malicious device fails to submit a feature report, resulting in a denial of service.
Statement: This issue has been fixed in Red Hat Enterprise Linux 9.2 via RHSA-2023:2458 [1].
[1]. https://
Red Hat
kernel: gadgetfs: ep_io - wait until IRQ finishes
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-50028 [MEDIUM] CWE-121 kernel: gadgetfs: ep_io - wait until IRQ finishes
kernel: gadgetfs: ep_io - wait until IRQ finishes
In the Linux kernel, the following vulnerability has been resolved:
gadgetfs: ep_io - wait until IRQ finishes
after usb_ep_queue() if wait_for_completion_interruptible() is
interrupted we need to wait until IRQ gets finished.
Otherwise complete() from epio_complete() can corrupt stack.
A flaw was found in the gadgetfs module in the Linux kernel. If the wait_for_completion_interruptible() function is interrupted, the driver does not wait for the interrupt to finish, causing stack corruption and resulting in a denial of service.
Statement: This issue has been fixed in Red Hat Enterprise Linux 9.2 via RHSA-2023:2458 [1].
[1]. https://access.redhat.com/errata/RHSA-2023:2458
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Packa
Red Hat
kernel: ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-50123 [MEDIUM] CWE-911 kernel: ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
kernel: ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
In the Linux kernel, the following vulnerability has been resolved:
ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
of_parse_phandle() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Fix missing of_node_put() in error paths.
A flaw was found in the mt8173-rt5650-rt5676 module in the Linux kernel. A missing decrement of the reference count when an error occurs will cause a memory leak, potentially impacting system performance and resulting in a denial of service.
Statement: This issue has been fixed in Red Hat Enterprise Linux 9.2 via RHSA-2023:2458 [1].
[1]. https://access.redhat.com/errata/RHSA-2023:2458
Package: ker
Red Hat
kernel: usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc()
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-50139 [MEDIUM] CWE-911 kernel: usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc()
kernel: usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc()
In the Linux kernel, the following vulnerability has been resolved:
usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc()
We should call of_node_put() for the reference returned by
of_get_child_by_name() which has increased the refcount.
A flaw was found in the aspeed-vhub module in the Linux kernel. A missing decrement of the reference count will cause a memory leak, potentially impacting system performance and resulting in a denial of service.
Statement: This issue has been fixed in Red Hat Enterprise Linux 9.2 via RHSA-2023:2458 [1].
[1]. https://access.redhat.com/errata/RHSA-2023:2458
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affec
Red Hat
kernel: icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.
vendor_redhat·2025-02-26·CVSS 4.7
CVE-2022-49632 [MEDIUM] CWE-362 kernel: icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.
kernel: icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.
In the Linux kernel, the following vulnerability has been resolved:
icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr.
While reading sysctl_icmp_errors_use_inbound_ifaddr, it can be changed
concurrently. Thus, we need to add READ_ONCE() to its reader.
A flaw was found in the Linux kernel's ICMP protocol. A race condition can occur when reading the sysctl_icmp_errors_use_inbound_ifaddr resource due to a missing lock, potentially impacting system stability and resulting in a denial of service.
Statement: This issue has been fixed in Red Hat Enterprise Linux 9.2 via RHSA-2023:2458 [1].
[1]. https://access.redhat.com/errata/RHSA-2023:2458
Mitigation: Mitigation for this issue is either not availabl
Red Hat
kernel: icmp: Fix data-races around sysctl.
vendor_redhat·2025-02-26·CVSS 4.7
CVE-2022-49638 [MEDIUM] CWE-362 kernel: icmp: Fix data-races around sysctl.
kernel: icmp: Fix data-races around sysctl.
In the Linux kernel, the following vulnerability has been resolved:
icmp: Fix data-races around sysctl.
While reading icmp sysctl variables, they can be changed concurrently.
So, we need to add READ_ONCE() to avoid data-races.
A flaw was found in the Linux kernel's ICMP protocol. A race condition can occur when reading the ICMP sysctl variables due to a missing lock, potentially impacting system stability and resulting in a denial of service.
Statement: This issue has been fixed in Red Hat Enterprise Linux 9.2 via RHSA-2023:2458 [1].
[1]. https://access.redhat.com/errata/RHSA-2023:2458
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising e
Chrome
Long Term Support Channel Update for ChromeOS: CVE-2023-2458
vendor_chrome·2023-05-25·CVSS 8.8
CVE-2023-2458 [HIGH] Long Term Support Channel Update for ChromeOS: CVE-2023-2458
Long Term Support Channel Update for ChromeOS
CVE-2023-2458
GHSA
GHSA-p36v-2c7w-2x8f: Use after free in ChromeOS Camera in Google Chrome on ChromeOS prior to 113
ghsa_unreviewed·2023-05-12
CVE-2023-2458 [HIGH] CWE-416 GHSA-p36v-2c7w-2x8f: Use after free in ChromeOS Camera in Google Chrome on ChromeOS prior to 113
Use after free in ChromeOS Camera in Google Chrome on ChromeOS prior to 113.0.5672.114 allowed a remote attacker who convinced a user to engage in specific UI interaction to potentially exploit heap corruption via UI interaction. (Chromium security severity: High)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-1382 kernel: denial of service in tipc_conn_close
bugzilla·2023-03-11·CVSS 4.7
CVE-2023-1382 [MEDIUM] CVE-2023-1382 kernel: denial of service in tipc_conn_close
CVE-2023-1382 kernel: denial of service in tipc_conn_close
A data race happens between con is allocated and con->sock is set, leading to null pointer dereference when accessing con->sock->sk. The null pointer dereference issue was found in tipc protocol in net/tipc/topsrv.c in Linux before 6.0.
Reference:
https://lore.kernel.org/netdev/bc7bd3183f1c275c820690fc65b708238fe9e38e.1668807842.git.lucien.xin@gmail.com/T/#u
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2023:2148 https://access.redhat.com/errata/RHSA-2023:2148
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2023:2458 https://access.redhat.com/errata/RHSA-2023:2458
---
This bug is now closed. Further updates for in
Bugzilla
CVE-2022-28388 kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c
bugzilla·2022-04-07·CVSS 5.5
CVE-2022-28388 [MEDIUM] CVE-2022-28388 kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c
CVE-2022-28388 kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c
usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free.
Reference:
https://github.com/torvalds/linux/commit/3d3925ff6433f98992685a9679613a2cc97f3ce2
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 2073092]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2023:2148 https://access.redhat.com/errata/RHSA-2023:2148
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2023:2458 https://access.redhat.com/errata/RHSA-2023:2458
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
2023-05-12
Published