CVE-2023-3269
published 2023-07-11CVE-2023-3269: A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is…
PriorityP179high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
1.48%
71.1th percentile
A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code, escalate containers, and gain root privileges.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.37-1 (bookworm) | linux 6.1.37-1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.37-1 | 6.1.37-1 |
| linux | linux_kernel | >= 0 < 6.3.11-1 | 6.3.11-1 |
| linux | linux_kernel | >= 0 < 6.3.11-1 | 6.3.11-1 |
| linux | linux_kernel | >= 6.1 < 6.1.37 | 6.1.37 |
| linux | linux_kernel | >= 6.2 < 6.3.11 | 6.3.11 |
| msrc | cbl2_hyperv-daemons_5.15.158.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.122.1-2_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_kernel_5.10.188.1-1_on_cbl_mariner_1.0 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2023-3269 (StackRot/DirtyVMA) is a local privilege escalation via use-after-free in the Linux kernel memory management subsystem due to incorrect lock handling for VMA traversal; monitor for unexpected privilege escalation from local users or container escapes. ↗
- →The vulnerability is tracked under the alias 'DirtyVMA' / 'distros-[DirtyVMA]'; threat intel and log searches should include this alias. ↗
- →On Debian, the vulnerability is fixed in kernel 6.1.37-1 (bookworm) and 6.3.11-1 (forky/sid/trixie); systems running older kernel versions on these distributions should be considered vulnerable. ↗
- ·Red Hat Enterprise Linux (6, 7, 8, 9) and their kernel-rt variants are NOT affected because the vulnerable code was never introduced into RHEL kernel versions. ↗
- ·DOC 2 (Exploit-DB 52550) describes a DIFFERENT CVE (CVE-2025-40271, proc_readdir_de rb-tree UAF) and only references CVE-2023-3269 as a technique reference; no IOCs from that document are applicable to CVE-2023-3269 itself. ↗
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vulncheck7.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-oem-6.1 vulnerabilities
osv·2023-07-25·CVSS 7.8
CVE-2023-3269 [HIGH] linux-oem-6.1 vulnerabilities
linux-oem-6.1 vulnerabilities
Ruihan Li discovered that the memory management subsystem in the Linux
kernel contained a race condition when accessing VMAs in certain
conditions, leading to a use-after-free vulnerability. A local attacker
could possibly use this to cause a denial of service (system crash) or
execute arbitrary code. (CVE-2023-3269)
Querijn Voet discovered that a race condition existed in the io_uring
subsystem in the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-3389)
OSV
CVE-2023-3269: A vulnerability exists in the memory management subsystem of the Linux kernel
osv·2023-07-11·CVSS 7.8
CVE-2023-3269 [HIGH] CVE-2023-3269: A vulnerability exists in the memory management subsystem of the Linux kernel
A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code, escalate containers, and gain root privileges.
GHSA
GHSA-2j2w-8gvj-wjmj: A vulnerability exists in the memory management subsystem of the Linux kernel
ghsa_unreviewed·2023-07-11
CVE-2023-3269 [HIGH] CWE-416 GHSA-2j2w-8gvj-wjmj: A vulnerability exists in the memory management subsystem of the Linux kernel
A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code, escalate containers, and gain root privileges.
VulnCheck
Linux Kernel Use After Free
vulncheck·2023·CVSS 7.8
CVE-2023-3269 [HIGH] Linux Kernel Use After Free
Linux Kernel Use After Free
A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code, escalate containers, and gain root privileges.
Affected: Linux Kernel
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://securelist.com/exploits-and-vulnerabilities-q3-2024/114839/
Exploit PoC: https://vulncheck.com/xdb/e01c0a7c63c9
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2023-07-25·CVSS 7.8
CVE-2023-3389 [HIGH] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Ruihan Li discovered that the memory management subsystem in the Linux
kernel contained a race condition when accessing VMAs in certain
conditions, leading to a use-after-free vulnerability. A local attacker
could possibly use this to cause a denial of service (system crash) or
execute arbitrary code. (CVE-2023-3269)
Querijn Voet discovered that a race condition existed in the io_uring
subsystem in the Linux kernel, leading to a use-after-free vulnerability. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2023-3389)
Instructions: After a standard system update you need to reboot your computer to make
all the nece
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2023-07-25·CVSS 7.8
CVE-2023-35001 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Stonejiajia, Shir Tamari and Sagi Tzadik discovered that the OverlayFS
implementation in the Ubuntu Linux kernel did not properly perform
permission checks in certain situations. A local attacker could possibly
use this to gain elevated privileges. (CVE-2023-2640)
It was discovered that the IP-VLAN network driver for the Linux kernel did
not properly initialize memory in some situations, leading to an out-of-
bounds write vulnerability. An attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2023-3090)
Mingi Cho discovered that the netfilter subsystem in the Linux kernel did
not properly validate the status of a nft chain while per
Microsoft
Distros-[dirtyvma] privilege escalation via non-rcu-protected vma traversal
vendor_msrc·2023-07-11·CVSS 7.8
CVE-2023-3269 [HIGH] CWE-416 Distros-[dirtyvma] privilege escalation via non-rcu-protected vma traversal
Distros-[dirtyvma] privilege escalation via non-rcu-protected vma traversal
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Re
Red Hat
kernel: distros-[DirtyVMA] Privilege escalation via non-RCU-protected VMA traversal
vendor_redhat·2023-07-05·CVSS 7.8
CVE-2023-3269 [HIGH] CWE-416 kernel: distros-[DirtyVMA] Privilege escalation via non-RCU-protected VMA traversal
kernel: distros-[DirtyVMA] Privilege escalation via non-RCU-protected VMA traversal
A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code, escalate containers, and gain root privileges.
A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code, escalate containers, and gain root privileges.
Statement: The affected code was not introduced into any kernel v
Debian
CVE-2023-3269: linux - A vulnerability exists in the memory management subsystem of the Linux kernel. T...
vendor_debian·2023·CVSS 7.8
CVE-2023-3269 [HIGH] CVE-2023-3269: linux - A vulnerability exists in the memory management subsystem of the Linux kernel. T...
A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code, escalate containers, and gain root privileges.
Scope: local
bookworm: resolved (fixed in 6.1.37-1)
bullseye: resolved
forky: resolved (fixed in 6.3.11-1)
sid: resolved (fixed in 6.3.11-1)
trixie: resolved (fixed in 6.3.11-1)
No detection rules found.
Securelist
Exploits and vulnerabilities in Q3 2024
blogs_securelist·2024-12-06·CVSS 8.1
CVE-2024-47177 [HIGH] Exploits and vulnerabilities in Q3 2024
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most prevalent exploits
Vulnerability exploitation in APT attacks
Interesting vulnerabilities
CVE-2024-47177 (CUPS filters)
CVE-2024-38112 (MSHTML Spoofing)
CVE-2024-6387 (regreSSHion)
CVE-2024-3183 (Free IPA)
CVE-2024-45519 (Zimbra)
CVE-2024-5290 (Ubuntu wpa_supplicant)
Conclusion and advice
Authors
Alexander Kolesnikov
Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mitigations for whole sets of vulnerabilities in commonly used subsystems. For example, a log integrity check is set to appear in the Co
Securelist
Analyzing the vulnerability landscape in Q3 2024
blogs_securelist·2024-12-06·CVSS 8.1
CVE-2024-47177 [HIGH] Analyzing the vulnerability landscape in Q3 2024
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- Interesting vulnerabilities
- CVE-2024-47177 (CUPS filters)
- CVE-2024-38112 (MSHTML Spoofing)
- CVE-2024-6387 (regreSSHion)
- CVE-2024-3183 (Free IPA)
- CVE-2024-45519 (Zimbra)
- CVE-2024-5290 (Ubuntu wpa_supplicant)
- Conclusion and advice
Authors
- Alexander Kolesnikov
Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mitigations for whole sets of vulnerabilities in commonly used subsystems. For example, a log integrity check is set to appear in the Common Log Filing System (CLFS) in Windows, so the number
Bugzilla
CVE-2023-53571 kernel: drm/i915: Make intel_get_crtc_new_encoder() less oopsy
bugzilla·2025-10-04·CVSS 5.5
CVE-2023-53571 [MEDIUM] CVE-2023-53571 kernel: drm/i915: Make intel_get_crtc_new_encoder() less oopsy
CVE-2023-53571 kernel: drm/i915: Make intel_get_crtc_new_encoder() less oopsy
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: Make intel_get_crtc_new_encoder() less oopsy
The point of the WARN was to print something, not oops
straight up. Currently that is precisely what happens
if we can't find the connector for the crtc in the atomic
state. Get the dev pointer from the atomic state instead
of the potentially NULL encoder to avoid that.
(cherry picked from commit 3b6692357f70498f617ea1b31a0378070a0acf1c)
Discussion:
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025100453-CVE-2023-53571-3269@gregkh/T
http://seclists.org/fulldisclosure/2023/Jul/43http://www.openwall.com/lists/oss-security/2023/07/28/1http://www.openwall.com/lists/oss-security/2023/08/25/1http://www.openwall.com/lists/oss-security/2023/08/25/4https://access.redhat.com/security/cve/CVE-2023-3269https://bugzilla.redhat.com/show_bug.cgi?id=2215268https://lists.fedoraproject.org/archives/list/[email protected]/message/U6AAA64CUPSMBW6XDTXPQJ3KQWYQ4K7L/https://security.netapp.com/advisory/ntap-20230908-0001/https://www.openwall.com/lists/oss-security/2023/07/05/1http://seclists.org/fulldisclosure/2023/Jul/43http://www.openwall.com/lists/oss-security/2023/07/28/1http://www.openwall.com/lists/oss-security/2023/08/25/1http://www.openwall.com/lists/oss-security/2023/08/25/4https://access.redhat.com/security/cve/CVE-2023-3269https://bugzilla.redhat.com/show_bug.cgi?id=2215268https://lists.fedoraproject.org/archives/list/[email protected]/message/U6AAA64CUPSMBW6XDTXPQJ3KQWYQ4K7L/https://security.netapp.com/advisory/ntap-20230908-0001/https://www.openwall.com/lists/oss-security/2023/07/05/1
2023-07-11
Published
Exploited in the wild