CVE-2023-3141

2023-06-0920:15:10

Google

osv.dev

use-after-free

r592_remove

drivers/memstick/host/r592.c

local attacker

crash

device disconnect

kernel information leak

cve-2023-3141

linux kernel

7.1 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

5.7 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak.

CPENameOperatorVersion
linuxeq6.1.55-1
linuxeq6.1.90-1
linuxeq6.1.69-1~bpo11+1
linuxeq6.1.85-1
linuxeq6.1.38-2~bpo11+1
linuxeq6.1.38-4
linuxeq6.1.52-1
linuxeq6.1.67-1
linuxeq6.1.38-2
linuxeq6.3.4-1~exp1

Name	Operator	Version
linux	eq	6.1.55-1
linux	eq	6.1.90-1
linux	eq	6.1.69-1~bpo11+1
linux	eq	6.1.85-1
linux	eq	6.1.38-2~bpo11+1
linux	eq	6.1.38-4
linux	eq	6.1.52-1
linux	eq	6.1.67-1
linux	eq	6.1.38-2
linux	eq	6.3.4-1~exp1