CVE-2023-51780

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-51780
An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.

7.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.8 Release Notes
https://github.com/torvalds/linux/commit/24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3 Patch
https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html Mailing List Third Party Advisory
https://security.netapp.com/advisory/ntap-20240419-0001/
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.7:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.7:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.7:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.7:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.7:rc5:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
History

19 Apr 2024, 07:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20240419-0001/ -

01 Feb 2024, 18:51

Type Values Removed Values Added
CVSS v2 : unknown
v3 : 8.1 		v2 : unknown
v3 : 7.0

18 Jan 2024, 19:59

Type Values Removed Values Added
First Time Debian
Linux linux Kernel
Linux
Debian debian Linux
References () https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.8 - () https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.8 - Release Notes
References () https://github.com/torvalds/linux/commit/24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3 - () https://github.com/torvalds/linux/commit/24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3 - Patch
References () https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html - () https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html - () https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html - Mailing List, Third Party Advisory
CPE cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.7:rc4:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.7:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.7:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.7:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.7:rc3:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.1
CWE CWE-416

12 Jan 2024, 13:47

Type Values Removed Values Added
Summary
  • (es) Se descubrió un problema en el kernel de Linux anterior a 6.6.8. do_vcc_ioctl en net/atm/ioctl.c tiene un use after free debido a una condición de ejecución vcc_recvmsg.

11 Jan 2024, 21:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/01/msg00005.html -

11 Jan 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-11 19:15

Updated : 2024-04-19 07:15

NVD link : CVE-2023-51780

Mitre link : CVE-2023-51780

CVE.ORG link : CVE-2023-51780

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
CWE-416

Use After Free