PT-2023-5746 · Linux · Linux Kernel

CVE-2023-4610 · Published 2023-06-19 · Updated 2023-10-31

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:L/AC:H/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 6.4

Description The issue is related to a use-after-free flaw in the radix tree lookup function in the Linux Kernel's Radix tree node cache. This flaw may allow a local attacker to crash the system and lead to a kernel information leak, potentially impacting the confidentiality, integrity, and availability of protected information.

Recommendations For Linux Kernel versions prior to 6.4, consider upgrading to version 6.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the radix tree lookup function until a patch is available.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

BDU:2023-06418

CVE-2023-4610

Affected Products

Linux Kernel

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2023-4610 · Security Note
• https://bdu.fstec.ru/vul/2023-06418 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-4610 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-4610 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-4610 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4610 · Note
• https://spinics.net/lists/kernel/msg4920917.html · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2229691 · Note
• https://t.me/cibsecurity/73229 · Telegram Post
• https://bugzilla.suse.com/show_bug.cgi?id=1215932 · Note
• https://lore.kernel.org/all/[e-mail]/T/#ma8722a9c77a812c0624818a4b8e10bba9e920213 · Note
• https://twitter.com/ZhiyuZhang6/status/1711308249012830473 · Twitter Post