PT-2023-1612 · Linux+3 · Linux Kernel+3

Palash Oswal

·

Published

2022-12-03

·

Updated

2024-03-25

·

CVE-2023-26605

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel version 6.0.8
Description The issue is related to a use-after-free in the inode cgwb move to attached() function in fs/fs-writeback.c, which is connected to the list del entry valid() function. This could potentially allow an attacker to impact the confidentiality, integrity, and availability of protected information.
Recommendations For Linux kernel version 6.0.8, consider applying a patch or updating to a newer version that fixes the use-after-free issue in the inode cgwb move to attached() function. As a temporary workaround, consider restricting access to the fs/fs-writeback.c component until a patch is available.

Exploit

Fix

Use After Free

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2022-3272
ALT-PU-2022-3273
ALT-PU-2022-3303
ALT-PU-2023-1044
BDU:2023-01111
CVE-2023-26605
USN-5911-1
USN-5912-1
USN-5929-1
USN-5935-1
USN-5938-1
USN-5941-1
USN-5950-1
USN-5962-1
USN-6032-1

Affected Products

Alt Linux
Linuxmint
Linux Kernel
Ubuntu