PT-2022-6717 · Linux+5 · Linux Kernel+5

Dhananjay Arunesh · Published 2022-04-22 · Updated 2025-03-10 · CVE-2023-3439

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw was found in the MCTP protocol in the Linux kernel. The function mctp unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object, potentially leading to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Use After Free

Race Condition

Weakness Enumeration

CWE-416

CWE-362

Related Identifiers

ALT-PU-2023-4894

AZL-27329

AZL-27348

BDU:2023-03668

CVE-2023-3439

USN-6246-1

USN-6255-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Linux Kernel

Red Os

Ubuntu

References · 38

• https://github.com/torvalds/linux/commit/b561275d633bcd8e0e8055ab86f1a13df75a0269 · Patch
• https://ubuntu.com/security/CVE-2023-3439 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6246-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6255-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-35001 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2024-0416SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-3439 · Vendor Advisory
• http://openwall.com/lists/oss-security/2023/07/02/1 · Patch
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-1023SE17 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-3390 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2217915 · Patch
• https://ubuntu.com/security/CVE-2023-31248 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6246-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-3439 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-3439 · Vendor Advisory