PT-2023-5679 · Linux+7 · Linux Kernel+7
Publicado
2023-09-28
·
Atualizado
2026-03-31
·
CVE-2023-5345
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation. In case of an error in
smb3 fs context parse param, ctx->password was freed but the field was not set to NULL which could lead to double free.Recommendations
Upgrade past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705 to resolve the issue. As a temporary workaround, consider disabling the
smb3 fs context parse param function until a patch is available. Restrict access to the vulnerable fs/smb/client component to minimize the risk of exploitation. Avoid using the ctx->password field in the affected component until the issue is resolved.Exploit
Correção
LPE
Use After Free
Double Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Astra Linux
Linuxmint
Linux Kernel
Red Hat
Red Os
Suse
Ubuntu