CVE-2023-52566
published 2024-03-02CVE-2023-52566: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() In…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.22%
12.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the
reference count of bh when the call to nilfs_dat_translate() fails. If
the reference count hits 0 and its owner page gets unlocked, bh may be
freed. However, bh->b_page is dereferenced to put the page after that,
which may result in a use-after-free bug. This patch moves the release
operation after unlocking and putting the page.
NOTE: The function in question is only called in GC, and in combination
with current userland tools, address translation using DAT does not occur
in that function, so the code path that causes this issue will not be
executed. However, it is possible to run that code path by intentionally
modifying the userland GC library or by calling the GC ioctl directly.
[[email protected]: NOTE added to the commit log]
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.64-1 (bookworm) | linux 6.1.64-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= a3d93f709e893187d301aa5458b2248db9f22bd1 < fb1084e63ee56958b0a56e17a50a4fd86445b9c1 | fb1084e63ee56958b0a56e17a50a4fd86445b9c1 |
| linux | linux | >= a3d93f709e893187d301aa5458b2248db9f22bd1 < bb61224f6abc8e71bfdf06d7c984e23460875f5b | bb61224f6abc8e71bfdf06d7c984e23460875f5b |
| linux | linux | >= a3d93f709e893187d301aa5458b2248db9f22bd1 < 193b5a1c6c67c36b430989dc063fe7ea4e200a33 | 193b5a1c6c67c36b430989dc063fe7ea4e200a33 |
| linux | linux | >= a3d93f709e893187d301aa5458b2248db9f22bd1 < 7130a87ca32396eb9bf48b71a2d42259ae44c6c7 | 7130a87ca32396eb9bf48b71a2d42259ae44c6c7 |
| linux | linux | >= a3d93f709e893187d301aa5458b2248db9f22bd1 < 3936e8714907cd55e37c7cc50e50229e4a9042e8 | 3936e8714907cd55e37c7cc50e50229e4a9042e8 |
| linux | linux | >= a3d93f709e893187d301aa5458b2248db9f22bd1 < 980663f1d189eedafd18d80053d9cf3e2ceb5c8c | 980663f1d189eedafd18d80053d9cf3e2ceb5c8c |
| linux | linux | >= a3d93f709e893187d301aa5458b2248db9f22bd1 < 28df4646ad8b433340772edc90ca709cdefc53e2 | 28df4646ad8b433340772edc90ca709cdefc53e2 |
| linux | linux | >= a3d93f709e893187d301aa5458b2248db9f22bd1 < 7ee29facd8a9c5a26079148e36bcf07141b3a6bc | 7ee29facd8a9c5a26079148e36bcf07141b3a6bc |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.205-1 | 5.10.205-1 |
| linux | linux_kernel | >= 0 < 6.1.64-1 | 6.1.64-1 |
| linux | linux_kernel | >= 0 < 6.5.6-1 | 6.5.6-1 |
| linux | linux_kernel | >= 0 < 6.5.6-1 | 6.5.6-1 |
| linux | linux_kernel | >= 0 < 4.4.0-254.288 | 4.4.0-254.288 |
| linux | linux_kernel | >= 0 < 4.15.0-225.237 | 4.15.0-225.237 |
| linux | linux_kernel | >= 2.6.30 < 4.14.327 | 4.14.327 |
| linux | linux_kernel | >= 4.15 < 4.19.296 | 4.19.296 |
| linux | linux_kernel | >= 4.20 < 5.4.258 | 5.4.258 |
| linux | linux_kernel | >= 5.11 < 5.15.134 | 5.15.134 |
| linux | linux_kernel | >= 5.16 < 6.1.56 | 6.1.56 |
| linux | linux_kernel | >= 5.5 < 5.10.198 | 5.10.198 |
| linux | linux_kernel | >= 6.2 < 6.5.6 | 6.5.6 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-aws-hwe vulnerabilities
osv·2024-05-23·CVSS 5.5
CVE-2023-47233 [MEDIUM] linux-aws-hwe vulnerabilities
linux-aws-hwe vulnerabilities
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Block layer subsystem;
- Userspace I/O drivers;
- Ceph distributed file system;
- Ext4 file system;
- JFS file system;
- NILFS2 file system;
- Bluetooth subsystem;
- Networking core;
- IPv4 networking;
- IPv6 networking;
- Logical Link layer;
- MAC80211 subsystem;
- Netlink;
- NFC subsystem;
-
OSV
linux-gcp vulnerabilities
osv·2024-05-21·CVSS 5.5
CVE-2023-47233 [MEDIUM] linux-gcp vulnerabilities
linux-gcp vulnerabilities
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Block layer subsystem;
- Userspace I/O drivers;
- Ceph distributed file system;
- Ext4 file system;
- JFS file system;
- NILFS2 file system;
- Bluetooth subsystem;
- Networking core;
- IPv4 networking;
- IPv6 networking;
- Logical Link layer;
- MAC80211 subsystem;
- Netlink;
- NFC subsystem;
- Tom
OSV
linux-azure vulnerabilities
osv·2024-05-20·CVSS 5.5
CVE-2023-47233 [MEDIUM] linux-azure vulnerabilities
linux-azure vulnerabilities
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Block layer subsystem;
- Userspace I/O drivers;
- Ceph distributed file system;
- Ext4 file system;
- JFS file system;
- NILFS2 file system;
- Bluetooth subsystem;
- Networking core;
- IPv4 networking;
- IPv6 networking;
- Logical Link layer;
- MAC80211 subsystem;
- Netlink;
- NFC subsystem;
- T
OSV
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
osv·2024-05-16·CVSS 5.5
CVE-2023-47233 [MEDIUM] linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
linux, linux-aws, linux-kvm, linux-lts-xenial vulnerabilities
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Ext4 file system;
- JFS file system;
- NILFS2 file system;
- Core kernel;
- Bluetooth subsystem;
- Networking core;
- IPv4 networking;
- Logical Link layer;
- MAC80211 subsystem;
- Netlink;
- NFC subsystem;
- Tomoyo security module;
(CVE-2023-52601, CVE-2024-266
OSV
linux, linux-aws, linux-azure-4.15, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities
osv·2024-05-16·CVSS 5.5
CVE-2023-47233 [MEDIUM] linux, linux-aws, linux-azure-4.15, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities
linux, linux-aws, linux-azure-4.15, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle vulnerabilities
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Block layer subsystem;
- Userspace I/O drivers;
- Ceph distributed file system;
- Ext4 file system;
- JFS file system;
- NILFS2 file system;
- Bluetooth subsystem;
- Networking core;
- IPv4 networking;
- IPv6 networking;
GHSA
GHSA-4c64-w6qg-97qw: In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
In nilf
ghsa_unreviewed·2024-03-03
CVE-2023-52566 [MEDIUM] CWE-416 GHSA-4c64-w6qg-97qw: In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
In nilf
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the
reference count of bh when the call to nilfs_dat_translate() fails. If
the reference count hits 0 and its owner page gets unlocked, bh may be
freed. However, bh->b_page is dereferenced to put the page after that,
which may result in a use-after-free bug. This patch moves the release
operation after unlocking and putting the page.
NOTE: The function in question is only called in GC, and in combination
with current userland tools, address translation using DAT does not occur
in that function, so the code path that causes this issue will not be
executed. However, it is possible to r
OSV
CVE-2023-52566: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() In nilfs_
osv·2024-03-02·CVSS 5.5
CVE-2023-52566 [MEDIUM] CVE-2023-52566: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() In nilfs_
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2024-05-23·CVSS 5.5
CVE-2024-26635 [MEDIUM] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Block layer subsystem;
- Userspace I/O drivers;
- Ceph distributed file system;
- Ext4 file system;
- JFS file system;
- NILFS2 file system;
- Bluetooth subsystem;
- Networking core;
- IPv4 networking;
- IPv6 network
Ubuntu
Linux kernel (GCP) vulnerabilities
vendor_ubuntu·2024-05-21·CVSS 5.5
CVE-2024-26614 [MEDIUM] Linux kernel (GCP) vulnerabilities
Title: Linux kernel (GCP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Block layer subsystem;
- Userspace I/O drivers;
- Ceph distributed file system;
- Ext4 file system;
- JFS file system;
- NILFS2 file system;
- Bluetooth subsystem;
- Networking core;
- IPv4 networking;
- IPv6 network
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2024-05-20·CVSS 5.5
CVE-2023-47233 [MEDIUM] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Block layer subsystem;
- Userspace I/O drivers;
- Ceph distributed file system;
- Ext4 file system;
- JFS file system;
- NILFS2 file system;
- Bluetooth subsystem;
- Networking core;
- IPv4 networking;
- IPv6 netwo
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-05-16·CVSS 5.5
CVE-2021-46939 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Ext4 file system;
- JFS file system;
- NILFS2 file system;
- Core kernel;
- Bluetooth subsystem;
- Networking core;
- IPv4 networking;
- Logical Link layer;
- MAC80211 subsystem;
- Netlink;
- NFC subsystem;
- Tomoyo securi
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-05-16·CVSS 5.5
CVE-2023-52524 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Block layer subsystem;
- Userspace I/O drivers;
- Ceph distributed file system;
- Ext4 file system;
- JFS file system;
- NILFS2 file system;
- Bluetooth subsystem;
- Networking core;
- IPv4 networking;
- IPv6 networking;
-
Red Hat
kernel: nilfs2: potential use after free in nilfs_gccache_submit_read_data()
vendor_redhat·2024-03-02·CVSS 5.5
CVE-2023-52566 [MEDIUM] CWE-416 kernel: nilfs2: potential use after free in nilfs_gccache_submit_read_data()
kernel: nilfs2: potential use after free in nilfs_gccache_submit_read_data()
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the
reference count of bh when the call to nilfs_dat_translate() fails. If
the reference count hits 0 and its owner page gets unlocked, bh may be
freed. However, bh->b_page is dereferenced to put the page after that,
which may result in a use-after-free bug. This patch moves the release
operation after unlocking and putting the page.
NOTE: The function in question is only called in GC, and in combination
with current userland tools, address translation using DAT does not occur
in that function, so the code pat
Debian
CVE-2023-52566: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix...
vendor_debian·2023·CVSS 5.5
CVE-2023-52566 [MEDIUM] CVE-2023-52566: linux - In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix...
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/193b5a1c6c67c36b430989dc063fe7ea4e200a33https://git.kernel.org/stable/c/28df4646ad8b433340772edc90ca709cdefc53e2https://git.kernel.org/stable/c/3936e8714907cd55e37c7cc50e50229e4a9042e8https://git.kernel.org/stable/c/7130a87ca32396eb9bf48b71a2d42259ae44c6c7https://git.kernel.org/stable/c/7ee29facd8a9c5a26079148e36bcf07141b3a6bchttps://git.kernel.org/stable/c/980663f1d189eedafd18d80053d9cf3e2ceb5c8chttps://git.kernel.org/stable/c/bb61224f6abc8e71bfdf06d7c984e23460875f5bhttps://git.kernel.org/stable/c/fb1084e63ee56958b0a56e17a50a4fd86445b9c1https://git.kernel.org/stable/c/193b5a1c6c67c36b430989dc063fe7ea4e200a33https://git.kernel.org/stable/c/28df4646ad8b433340772edc90ca709cdefc53e2https://git.kernel.org/stable/c/3936e8714907cd55e37c7cc50e50229e4a9042e8https://git.kernel.org/stable/c/7130a87ca32396eb9bf48b71a2d42259ae44c6c7https://git.kernel.org/stable/c/7ee29facd8a9c5a26079148e36bcf07141b3a6bchttps://git.kernel.org/stable/c/980663f1d189eedafd18d80053d9cf3e2ceb5c8chttps://git.kernel.org/stable/c/bb61224f6abc8e71bfdf06d7c984e23460875f5bhttps://git.kernel.org/stable/c/fb1084e63ee56958b0a56e17a50a4fd86445b9c1
2024-03-02
Published