PT-2023-3346 · Linux+3 · Linux Kernel+3

Zheng Wang · Published 2023-04-10 · Updated 2024-04-15 · CVE-2023-35826

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.3.2

Description The issue is related to a use-after-free vulnerability in the cedrus remove() function in the drivers/staging/media/sunxi/cedrus/cedrus.c module of the Linux kernel. This vulnerability is caused by a race condition due to concurrent access to a resource, allowing an attacker to potentially impact the confidentiality, integrity, and availability of protected information.

Recommendations For Linux kernel versions prior to 6.3.2, update to version 6.3.2 or later to resolve the issue. As a temporary workaround, consider disabling the cedrus remove() function until a patch is available. Restrict access to the vulnerable module drivers/staging/media/sunxi/cedrus/cedrus.c to minimize the risk of exploitation.

Fix

Race Condition

Use After Free

Weakness Enumeration

CWE-362

CWE-416

Related Identifiers

ALT-PU-2023-1878

ALT-PU-2023-1881

ALT-PU-2023-4663

ALT-PU-2024-4263

ALT-PU-2024-4843

AZL-27243

AZL-27331

BDU:2023-03502

CVE-2023-35826

USN-6283-1

Affected Products

Alt Linux

Linux Kernel

Red Os

Ubuntu

References · 31

• https://osv.dev/vulnerability/UBUNTU-CVE-2023-35826 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35826 · Security Note
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=50d0a7aea4809cef87979d4669911276aa23b71f · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.2 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-27243 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-35826 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-35826 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-35826 · Vendor Advisory
• https://lore.kernel.org/linux-arm-kernel/20230308032333.1893394-1-zyytlz.wz%40163.com/T · Patch
• https://ubuntu.com/security/notices/USN-6283-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-35826 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03502 · Security Note
• https://osv.dev/vulnerability/AZL-27331 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-35826 · Security Note