PT-2022-6379 · Linux+4 · Linux Kernel+4

Palash Oswal · Published 2022-11-12 · Updated 2024-04-15 · CVE-2023-26606

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.0.8

Description The issue is related to a use-after-free vulnerability in the ntfs trim fs() function of the fs/ntfs3/bitmap.c component in the Linux kernel. This vulnerability may allow an attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability is associated with the use of memory after it has been freed.

Recommendations For Linux kernel version 6.0.8, consider disabling the ntfs trim fs() function as a temporary workaround until a patch is available. Restrict access to the fs/ntfs3/bitmap.c component to minimize the risk of exploitation. Avoid using the affected kernel version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2023-1011

ALT-PU-2023-1015

ALT-PU-2023-1016

ALT-PU-2023-1044

ALT-PU-2023-7007

ALT-PU-2023-7682

ALT-PU-2024-4263

ALT-PU-2024-4843

BDU:2023-01112

CVE-2023-26606

USN-5982-1

USN-5987-1

USN-6004-1

USN-6024-1

USN-6123-1

USN-6174-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Linux Kernel

Ubuntu

References · 61

• 🔥 https://lkml.org/lkml/2023/2/20/860 · Exploit
• https://ubuntu.com/security/CVE-2023-0045 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1032 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1281 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-47929 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-41218 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2196 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5987-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6004-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48423 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6123-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6174-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0459 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-23455 · Vendor Advisory