Lucene search

Redhat.comRH:CVE-2023-51043

HistoryJan 25, 2024 - 6:10 p.m.

CVE-2023-51043

2024-01-2518:10:50

redhat.com

access.redhat.com

cve-2023-51043

flaw

linux kernel

dri

use-after-free

race condition

driver unload

local user

system crash

privilege escalation

mitigation

blacklist module

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

6.5 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

LOCAL

Access Complexity

HIGH

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:H/Au:S/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

8.4%

JSON

A flaw was found in the Linux kernel Direct Rendering Infrastructure (DRI) subsystem in which a use-after-free can be caused when a user triggers a race condition between a nonblocking atomic commit and a driver unload. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

Mitigation

To mitigate this issue, prevent module drm from being loaded. Please see <https://access.redhat.com/solutions/41278> for how to blacklist a kernel module to prevent it from loading automatically.