PT-2023-2978 · Linux+4 · Linux Kernel+4

Butt3Rflyh4Ck · Published 2023-05-26 · Updated 2024-02-01 · CVE-2023-2898

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a null-pointer-dereference flaw in the f2fs write end io() function in the fs/f2fs/data.c module of the Linux kernel's f2fs file system. This flaw is caused by a race condition due to concurrent access to resources. Exploitation of this issue can allow a local privileged user to cause a denial of service problem.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Race Condition

NULL Pointer Dereference

Weakness Enumeration

CWE-362

CWE-476

Related Identifiers

BDU:2023-02996

CVE-2023-2898

DLA-3623-1

DSA-5480-1

DSA-5492-1

OESA-2023-1781

OESA-2023-1782

OESA-2023-1783

USN-6285-1

USN-6338-1

USN-6338-2

USN-6339-1

USN-6339-2

USN-6339-3

USN-6339-4

USN-6344-1

USN-6350-1

USN-6351-1

USN-6385-1

Affected Products

Astra Linux

Linuxmint

Linux Kernel

Red Os

Ubuntu

References · 142

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/gameoverlay_privesc.rb · Exploit
• 🔥 https://github.com/synacktiv/CVE-2023-35001 · Exploit
• 🔥 https://github.com/g1vi/CVE-2023-2640-CVE-2023-32629 · Exploit
• 🔥 https://github.com/ThrynSec/CVE-2023-32629-CVE-2023-2640---POC-Escalation · Exploit
• 🔥 https://github.com/lrh2000/CVE-2023-2002 · Exploit
• 🔥 https://github.com/TurtleARM/CVE-2023-3338-DECPwn · Exploit
• 🔥 https://github.com/kaotickj/Check-for-CVE-2023-32629-GameOver-lay · Exploit
• 🔥 https://github.com/syedhafiz1234/nftables-oob-read-write-exploit-CVE-2023-35001- · Exploit
• https://ubuntu.com/security/CVE-2023-2002 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-0458 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-31084 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6344-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45863 · Security Note
• https://ubuntu.com/security/CVE-2023-28328 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2898 · Vendor Advisory