PT-2023-1005 · Linux+2 · Linux Kernel+2

Zi Fan Tan · Published 2023-05-13 · Updated 2024-01-19 · CVE-2023-21255

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a memory corruption vulnerability due to a use after free in multiple functions of binder.c. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. The vulnerability is also associated with the incorrect determination of the size of the buffer being freed in the binder free buf() function of the drivers/android/binder driver.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Memory Corruption

Weakness Enumeration

CWE-416

CWE-787

Related Identifiers

ASB-A-275041864

BDU:2023-03781

CVE-2023-21255

DLA-3623-1

DSA-5480-1

OESA-2023-1467

OESA-2023-1468

OESA-2023-1469

OESA-2023-1470

OESA-2023-1471

USN-6338-1

USN-6338-2

USN-6339-1

USN-6339-2

USN-6339-3

USN-6339-4

USN-6340-1

USN-6340-2

USN-6344-1

USN-6349-1

USN-6350-1

USN-6351-1

USN-6357-1

USN-6397-1

Affected Products

Linuxmint

Linux Kernel

Ubuntu

References · 100

• https://ubuntu.com/security/CVE-2023-2002 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6340-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-31084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-21255 · Security Note
• https://ubuntu.com/security/notices/USN-6344-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3812 · Security Note
• https://osv.dev/vulnerability/USN-6349-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6350-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-32258 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-3776 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-3268 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-48425 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-32247 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6338-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6339-1 · Vendor Advisory