PT-2023-1705 · Linux+3 · Linux Kernel+3

Thadeu Cascardo + 1 · Published 2023-03-08 · Updated 2024-11-21 · CVE-2023-1032

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to the version containing the fix for the issue introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067

Description The issue is related to a double free in the sys socket file() function, which can be exploited to cause a denial of service. The problem is associated with the io uring IORING OP SOCKET operation in the Linux kernel.

Recommendations For Linux kernel versions prior to the fix, consider disabling the sys socket file() function as a temporary workaround until a patch is available. Restrict access to the io uring IORING OP SOCKET operation to minimize the risk of exploitation. Update to a version of the Linux kernel that contains the fix for the issue introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067.

Fix

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

ALT-PU-2024-14046

ALT-PU-2024-6818

BDU:2023-01279

CVE-2023-1032

USN-5977-1

USN-6024-1

USN-6033-1

Affected Products

Alt Linux

Linuxmint

Linux Kernel

Ubuntu

References · 47

• https://ubuntu.com/security/CVE-2023-22997 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1032 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-30456 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6024-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-28328 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-5977-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-26545 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1118 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1670 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1583 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2196 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-1032 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1998 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3424 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01279 · Security Note