CVE-2023-1032

2024-01-0818:11:31

CWE-415

canonical

www.cve.org

linux kernel

io_uring

double free

vulnerability

fixed

CVSS3

4.7

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H

AI Score

6.5

Confidence

High

EPSS

Percentile

5.1%

JSON

The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067.

CNA Affected

[
  {
    "packageName": "linux",
    "product": "linux",
    "vendor": "The Linux Kernel Organization",
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git",
    "platforms": [
      "Linux"
    ],
    "versions": [
      {
        "lessThan": "6.3~rc2",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]