Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-23039
HistoryFeb 22, 2023 - 12:00 a.m.

CVE-2023-23039

2023-02-2200:00:00
ubuntu.com
ubuntu.com
10
linux kernel
use-after-free
drivers/tty/vcc.c
race condition
vulnerability
open()
vcc device

5.7 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

0.0004 Low

EPSS

Percentile

15.8%

An issue was discovered in the Linux kernel through 6.2.0-rc2.
drivers/tty/vcc.c has a race condition and resultant use-after-free if a
physically proximate attacker removes a VCC device while calling open(),
aka a race condition between vcc_open() and vcc_remove().

Bugs

Notes

Author Note
cascardo CONFIG_VCC depends on CONFIG_SUN_LDOMS, which is SPARC only

5.7 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

0.0004 Low

EPSS

Percentile

15.8%