PT-2021-7682 · Linux+5 · Linux Kernel+5

Yangerkun · Published 2021-10-29 · Updated 2023-11-14 · CVE-2023-1252

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free flaw was found in the Linux kernel’s Ext4 File System related to the overlay FS usage. This issue allows a local user to crash or potentially escalate their privileges on the system. The flaw is associated with the ovl write iter() function of the overlayfs file system and the use of memory after it has been freed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2023:7077

ALT-PU-2021-3304

ALT-PU-2021-3305

ALT-PU-2021-3306

ALT-PU-2021-3330

ALT-PU-2021-3337

ALT-PU-2021-3341

ALT-PU-2021-3451

ALT-PU-2021-3458

ALT-PU-2021-3468

ALT-PU-2021-3469

ALT-PU-2021-3485

ALT-PU-2021-3563

ALT-PU-2021-3573

ALT-PU-2021-3618

ALT-PU-2022-1428

ALT-PU-2023-1627

ALT-PU-2023-4894

AZL-25741

BDU:2023-01273

CESA-2023_6901

CESA-2023_7077

CVE-2023-1252

RHSA-2023:6583

RHSA-2023:6901

RHSA-2023:7077

RHSA-2023_6583

RHSA-2023_6901

RHSA-2023_7077

RHSA-2024:0724

RHSA-2024:8107

RHSA-2024:8613

RHSA-2024:8614

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linux Kernel

Red Hat

References · 129

• https://errata.almalinux.org/8/ALSA-2023-7077.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-1252 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1252 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1252 · Security Note
• https://osv.dev/vulnerability/ALSA-2023:7077 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-1252 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01273 · Security Note
• https://linux.oracle.com/errata/ELSA-2023-6583.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-1252 · Security Note
• https://linux.oracle.com/errata/ELSA-2023-7077.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-1252 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-1252 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-25741 · Vendor Advisory
• https://bugzilla.redhat.com/2073091 · Note
• https://access.redhat.com/security/cve/CVE-2023-1206 · Note