Yüksek CVSS 7.8
CVE-2023-3609: Linux Kernel: serbest bırakılmış belleğin kullanımı
Açıklama (NVD)
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the reference counter in tcf_bind_filter(). If an attacker can control the reference counter and set it to zero, they can cause the reference to be freed, leading to a use-after-free vulnerability. We recommend upgrading past commit 04c55383fa5689357bcdd2c8036725a55ed632bc.
Özet bilgiler
- Ürün
- Linux Linux Kernel
- CVSS v3.1
- 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - EPSS
- %0,49 (yüzdelik 42)
- CWE
- CWE-416
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| linux-linux-kernel | 4.14 | — | 4.14.322 |
| linux-linux-kernel | 4.15 | — | 4.19.291 |
| linux-linux-kernel | 4.20 | — | 5.4.248 |
| linux-linux-kernel | 5.5 | — | 5.10.185 |
| linux-linux-kernel | 5.11 | — | 5.15.118 |
| linux-linux-kernel | 5.16 | — | 6.1.35 |
| linux-linux-kernel | 6.2 | — | 6.3.9 |
| linux-linux-kernel | 6.4 | 6.4 | — |
| linux-linux-kernel | 6.4 | 6.4 | — |
| linux-linux-kernel | 6.4 | 6.4 | — |
| linux-linux-kernel | 6.4 | 6.4 | — |
| linux-linux-kernel | 6.4 | 6.4 | — |
| linux-linux-kernel | 6.4 | 6.4 | — |
| debian-debian-linux | 10.0 | 10.0 | — |
| debian-debian-linux | 11.0 | 11.0 | — |
Kaynaklar
- NVD kaydı
- packetstormsecurity.com
- packetstormsecurity.com
- git.kernel.org
- kernel.dance
- lists.debian.org
- lists.debian.org
- security.netapp.com
- www.debian.org
- packetstormsecurity.com
- packetstormsecurity.com
- git.kernel.org
- kernel.dance
- lists.debian.org
- lists.debian.org
- security.netapp.com
- www.debian.org
- cert-portal.siemens.com
- cert-portal.siemens.com
- CWE-416