CVE-2023-1476 Kpatch: mm/mremap.c: incomplete fix for cve-2022-41222

2023-11-0308:07:00

CWE-416

redhat

www.cve.org

cve-2023-1476

kpatch

use-after-free

linux kernel

memory address space

race condition

system crash

privilege escalation

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.3%

JSON

A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privileges on the system.

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "Red Hat Enterprise Linux 8",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "defaultStatus": "unaffected",
    "packageName": "kpatch-patch",
    "cpes": [
      "cpe:/o:redhat:enterprise_linux:8::baseos"
    ]
  }
]