CVE-2023-3439
published 2023-06-28CVE-2023-3439: A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches…
PriorityP418medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.35%
27.7th percentile
A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object, potentially leading to a denial of service.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.17.6-1 (bookworm) | linux 5.17.6-1 (bookworm) |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.17.6-1 | 5.17.6-1 |
| linux | linux_kernel | >= 0 < 5.17.6-1 | 5.17.6-1 |
| linux | linux_kernel | >= 0 < 5.17.6-1 | 5.17.6-1 |
| linux | linux_kernel | >= 0 < 5.15.0-78.85 | 5.15.0-78.85 |
| linux | linux_kernel | 5.15 – 5.17 | — |
| msrc | cbl2_hyperv-daemons_5.15.126.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.126.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| msrc | cm1_kernel_5.10.185.1-1_on_cbl_mariner_1.0 | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian4.7MEDIUM
vendor_msrc4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-intel-iotg-5.15 vulnerabilities
osv·2023-07-26·CVSS 7.8
CVE-2023-3090 [HIGH] linux-intel-iotg-5.15 vulnerabilities
linux-intel-iotg-5.15 vulnerabilities
It was discovered that the IP-VLAN network driver for the Linux kernel did
not properly initialize memory in some situations, leading to an out-of-
bounds write vulnerability. An attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2023-3090)
Mingi Cho discovered that the netfilter subsystem in the Linux kernel did
not properly validate the status of a nft chain while performing a lookup
by id, leading to a use-after-free vulnerability. An attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2023-31248)
Querijn Voet discovered that a race condition existed in the io_uring
subsystem in the Linux kernel, leading to a use-after-free vulnerabi
OSV
linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-gkeop-5.15, linux-hwe-5
osv·2023-07-25·CVSS 7.8
[HIGH] linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-gkeop-5.15, linux-hwe-5
linux, linux-aws, linux-aws-5.15, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gke-5.15, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi vulnerabilities
It was discovered that the IP-VLAN network driver for the Linux kernel did
not properly initialize memory in some situations, leading to an out-of-
bounds write vulnerability. An attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2023-3090)
Mingi Cho discovered that the netfilter subsystem in the Linux kernel did
not properly validate the status of a nft chain while perfor
OSV
CVE-2023-3439: A flaw was found in the MCTP protocol in the Linux kernel
osv·2023-06-28·CVSS 4.7
CVE-2023-3439 [MEDIUM] CVE-2023-3439: A flaw was found in the MCTP protocol in the Linux kernel
A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object, potentially leading to a denial of service.
GHSA
GHSA-wh7q-2hgq-2xj7: A flaw was found in the MCTP protocol in the Linux kernel
ghsa_unreviewed·2023-06-28
CVE-2023-3439 [MEDIUM] CWE-416 GHSA-wh7q-2hgq-2xj7: A flaw was found in the MCTP protocol in the Linux kernel
A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object, potentially leading to a denial of service.
Ubuntu
Linux kernel (Intel IoTG) vulnerabilities
vendor_ubuntu·2023-07-26·CVSS 7.8
CVE-2023-35001 [HIGH] Linux kernel (Intel IoTG) vulnerabilities
Title: Linux kernel (Intel IoTG) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the IP-VLAN network driver for the Linux kernel did
not properly initialize memory in some situations, leading to an out-of-
bounds write vulnerability. An attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2023-3090)
Mingi Cho discovered that the netfilter subsystem in the Linux kernel did
not properly validate the status of a nft chain while performing a lookup
by id, leading to a use-after-free vulnerability. An attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2023-31248)
Querijn Voet discovered that a race condition existed in the
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2023-07-25·CVSS 7.8
CVE-2023-3390 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the IP-VLAN network driver for the Linux kernel did
not properly initialize memory in some situations, leading to an out-of-
bounds write vulnerability. An attacker could use this to cause a denial of
service (system crash) or possibly execute arbitrary code. (CVE-2023-3090)
Mingi Cho discovered that the netfilter subsystem in the Linux kernel did
not properly validate the status of a nft chain while performing a lookup
by id, leading to a use-after-free vulnerability. An attacker could use
this to cause a denial of service (system crash) or possibly execute
arbitrary code. (CVE-2023-31248)
Querijn Voet discovered that a race condition existed in the io_uring
subs
Red Hat
kernel: mctp: use-after-free read in mctp_local_output()
vendor_redhat·2023-06-26·CVSS 4.7
CVE-2023-3439 [MEDIUM] CWE-416 kernel: mctp: use-after-free read in mctp_local_output()
kernel: mctp: use-after-free read in mctp_local_output()
A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object, potentially leading to a denial of service.
A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object, potentially leading to a denial of service.
Statement: No Red Hat products are affected by this flaw, as the MCTP protocol is not supported in any shipping kernel release.
P
Microsoft
A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However a running routine may be unaware of t
vendor_msrc·2023-06-13·CVSS 4.7
CVE-2023-3439 [MEDIUM] CWE-416 A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However a running routine may be unaware of t
A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object potentially leading to a denial of service.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See t
Debian
CVE-2023-3439: linux - A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unr...
vendor_debian·2023·CVSS 4.7
CVE-2023-3439 [MEDIUM] CVE-2023-3439: linux - A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unr...
A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object, potentially leading to a denial of service.
Scope: local
bookworm: resolved (fixed in 5.17.6-1)
bullseye: resolved
forky: resolved (fixed in 5.17.6-1)
sid: resolved (fixed in 5.17.6-1)
trixie: resolved (fixed in 5.17.6-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2023/07/02/1https://bugzilla.redhat.com/show_bug.cgi?id=2217915https://github.com/torvalds/linux/commit/b561275d633bcd8e0e8055ab86f1a13df75a0269http://www.openwall.com/lists/oss-security/2023/07/02/1https://bugzilla.redhat.com/show_bug.cgi?id=2217915https://github.com/torvalds/linux/commit/b561275d633bcd8e0e8055ab86f1a13df75a0269
2023-06-28
Published