PT-2023-1005 · Linux+2 · Linux Kernel+2

Zi Fan Tan · Publicado 2023-05-13 · Atualizado 2024-01-19 · CVE-2023-21255

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a memory corruption vulnerability due to a use after free in multiple functions of binder.c. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. The vulnerability is also associated with the incorrect determination of the size of the buffer being freed in the binder free buf() function of the drivers/android/binder driver.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Memory Corruption

Enumeração de Fraquezas

CWE-416

CWE-787

Identificadores relacionados

ASB-A-275041864

BDU:2023-03781

CVE-2023-21255

DLA-3623-1

DSA-5480-1

OESA-2023-1467

OESA-2023-1468

OESA-2023-1469

OESA-2023-1470

OESA-2023-1471

USN-6338-1

USN-6338-2

USN-6339-1

USN-6339-2

USN-6339-3

USN-6339-4

USN-6340-1

USN-6340-2

USN-6344-1

USN-6349-1

USN-6350-1

USN-6351-1

USN-6357-1

USN-6397-1

Produtos afetados

Linuxmint

Linux Kernel

Ubuntu

Referências · 100

• https://ubuntu.com/security/CVE-2023-2002 · Aviso do Fabricante
• https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.5 · Nota
• https://lore.kernel.org/all/[e-mail] · Nota
• https://git.kernel.org/linus/bdc1c5fac982845a58d28690cdb56db8c88a530d · Nota
• https://ubuntu.com/security/notices/USN-6340-2 · Aviso do Fabricante
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1467 · Nota
• https://ubuntu.com/security/CVE-2023-31084 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-21255 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-6344-1 · Aviso do Fabricante
• https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1471 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-3812 · Nota de Segurança
• https://osv.dev/vulnerability/USN-6349-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-6350-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-32258 · Aviso do Fabricante
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.9 · Nota