CVE-2023-3159 — Use After Free in Kernel

CWE-416 — Use After Free11 documents8 sources

Severity

6.7MEDIUMNVD

OSV4.7

EPSS

0.0%

top 98.21%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Linux Kernel Debian Linux Msrc Cbl2 Kernel 5.15.116.1-2 ON CBL Mariner 2.0 +1 more

Timeline

PublishedJun 12

Latest updateSep 6

Description

A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages7 packages

▶NVDlinux/linux_kernel< 5.18+1

▶Debianlinux/linux_kernel< 5.10.120-1+3

▶Ubuntulinux/linux_kernel< 3.13.0-193.244+1

▶CVEListV5linux/linux_kernelKernel version prior to Kernel 5.18-rc6

▶debiandebian/linux< linux 5.17.11-1 (bookworm)

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

OSV

linux vulnerabilities↗2023-09-06

▶

OSV

linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities↗2023-07-26

▶

OSV

CVE-2023-3159: A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel↗2023-06-12

▶

GHSA

GHSA-rfm6-5mxx-g3r7: A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel↗2023-06-12

▶

📋Vendor Advisories

Ubuntu

Linux kernel vulnerabilities↗2023-09-06

▶

Ubuntu

Linux kernel vulnerabilities↗2023-07-26

▶

Microsoft

▶

Debian

CVE-2023-3159: linux - A use after free issue was discovered in driver/firewire in outbound_phy_packet_...↗2023

▶

Red Hat

kernel: use after free issue in driver/firewire in outbound_phy_packet_callback↗2022-04-09

▶

💬Community

Bugzilla

CVE-2023-3159 kernel: use after free issue in driver/firewire in outbound_phy_packet_callback↗2023-06-08

▶