CVE-2023-33250

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-33250
The Linux kernel 6.3 has a use-after-free in iopt_unmap_iova_range in drivers/iommu/iommufd/io_pagetable.c.

4.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugzilla.suse.com/show_bug.cgi?id=1211597
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=804ca14d04df09bf7924bacc5ad22a4bed80c94f
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dbe245cdf5189e88d680379ed13901356628b650
https://groups.google.com/g/syzkaller/c/G6P9yecsTZ8/m/iiqFVOM9BwAJ Mailing List Third Party Advisory
https://lore.kernel.org/linux-iommu/ZDabT%2FuRl%2FjxFhm0%40ip-172-31-85-199.ec2.internal/T/
https://security.netapp.com/advisory/ntap-20230622-0006/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:6.3:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
History

25 Mar 2024, 01:15

Type Values Removed Values Added
References
  • () https://bugzilla.suse.com/show_bug.cgi?id=1211597 -
  • () https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=804ca14d04df09bf7924bacc5ad22a4bed80c94f -
  • () https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=dbe245cdf5189e88d680379ed13901356628b650 -

07 Nov 2023, 04:14

Type Values Removed Values Added
References
  • {'url': 'https://lore.kernel.org/linux-iommu/ZDabT%2FuRl%2FjxFhm0@ip-172-31-85-199.ec2.internal/T/', 'name': 'https://lore.kernel.org/linux-iommu/ZDabT%2FuRl%2FjxFhm0@ip-172-31-85-199.ec2.internal/T/', 'tags': ['Vendor Advisory'], 'refsource': 'MISC'}
  • () https://lore.kernel.org/linux-iommu/ZDabT%2FuRl%2FjxFhm0%40ip-172-31-85-199.ec2.internal/T/ -

14 Aug 2023, 15:39

Type Values Removed Values Added
First Time Netapp h700s
Netapp h700s Firmware
Netapp h300s
Netapp h300s Firmware
Netapp h410s
Netapp h410s Firmware
Netapp h500s Firmware
Netapp
Netapp h500s
References (CONFIRM) https://security.netapp.com/advisory/ntap-20230622-0006/ - (CONFIRM) https://security.netapp.com/advisory/ntap-20230622-0006/ - Third Party Advisory
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 4.4
CPE cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

22 Jun 2023, 15:15

Type Values Removed Values Added
References
  • (CONFIRM) https://security.netapp.com/advisory/ntap-20230622-0006/ -

26 May 2023, 03:32

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
References (MISC) https://groups.google.com/g/syzkaller/c/G6P9yecsTZ8/m/iiqFVOM9BwAJ - (MISC) https://groups.google.com/g/syzkaller/c/G6P9yecsTZ8/m/iiqFVOM9BwAJ - Mailing List, Third Party Advisory
References (MISC) https://lore.kernel.org/linux-iommu/ZDabT%2FuRl%2FjxFhm0@ip-172-31-85-199.ec2.internal/T/ - (MISC) https://lore.kernel.org/linux-iommu/ZDabT%2FuRl%2FjxFhm0@ip-172-31-85-199.ec2.internal/T/ - Vendor Advisory
CPE cpe:2.3:o:linux:linux_kernel:6.3:*:*:*:*:*:*:*
CWE CWE-416
First Time Linux linux Kernel
Linux

21 May 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-05-21 21:15

Updated : 2024-03-25 01:15

NVD link : CVE-2023-33250

Mitre link : CVE-2023-33250

CVE.ORG link : CVE-2023-33250

JSON object : View

Products Affected

netapp

  • h700s_firmware
  • h700s
  • h300s_firmware
  • h410s
  • h500s_firmware
  • h410s_firmware
  • h500s
  • h300s

linux

  • linux_kernel
CWE
CWE-416

Use After Free