CVE-2023-2602 — Missing Release of Memory after Effective Lifetime in Project Libcap

CWE-401 — Missing Release of Memory after Effective Lifetime9 documents8 sources
Severity
3.3LOWNVD
EPSS
0.0%
top 96.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Libcap Project LibcapDebian LinuxFedoraproject Fedora+1 more
Timeline
PublishedJun 6
Latest updateJun 14

Description

A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error, which can exhaust the process memory.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 1.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5libcap_project/libcapNA

Also affects: Debian Linux 10.0, 11.0, 12.0, Fedora 37, 38, Enterprise Linux 6.0, 7.0, 8.0, 9.0

🔴Vulnerability Details

4
OSV
libcap2 vulnerabilities↗2023-06-14
▶
CVEList
CVE-2023-2602: A vulnerability was found in the pthread_create() function in libcap↗2023-06-06
▶
OSV
CVE-2023-2602: A vulnerability was found in the pthread_create() function in libcap↗2023-06-06
▶
GHSA
GHSA-7wq6-hwpj-wcq2: A vulnerability was found in the pthread_create() function in libcap↗2023-06-06
▶

📋Vendor Advisories

4
Ubuntu
libcap2 vulnerabilities↗2023-06-14
▶
Microsoft
A vulnerability was found in the pthread_create() function in libcap. This issue may allow a malicious actor to use cause __real_pthread_create() to return an error which can exhaust the process memor↗2023-06-13
▶
Red Hat
libcap: Memory Leak on pthread_create() Error↗2023-05-16
▶
Debian
CVE-2023-2602: libcap2 - A vulnerability was found in the pthread_create() function in libcap. This issue...↗2023
▶
CVE-2023-2602 — Libcap Project Libcap vulnerability | cvebase