CVE-2023-4133

2023-08-0300:00:00

ubuntu.com

cve-2023-4133

linux kernel

local user

crash

denial of service

cxgb4 driver

flower_stats_timer

work queue

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

5.1%

JSON

A use-after-free vulnerability was found in the cxgb4 driver in the Linux
kernel. The bug occurs when the cxgb4 device is detaching due to a possible
rearming of the flower_stats_timer from the work queue. This flaw allows a
local user to crash the system, causing a denial of service condition.

Notes

Author	Note
	Priority reason: Requires physical access or privilege to remove driver or unbind device.

OSVersionArchitecturePackageVersionFilename
ubuntu20.04noarchlinux< anyUNKNOWN
ubuntu22.04noarchlinux< anyUNKNOWN
ubuntu23.04noarchlinux< 6.2.0-25.25UNKNOWN
ubuntu20.04noarchlinux-aws< anyUNKNOWN
ubuntu22.04noarchlinux-aws< anyUNKNOWN
ubuntu23.04noarchlinux-aws< 6.2.0-1007.7UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< anyUNKNOWN
ubuntu22.04noarchlinux-aws-6.2< 6.2.0-1007.7~22.04.1UNKNOWN
ubuntu20.04noarchlinux-azure< anyUNKNOWN
ubuntu22.04noarchlinux-azure< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	20.04	noarch	linux	< any	UNKNOWN
ubuntu	22.04	noarch	linux	< any	UNKNOWN
ubuntu	23.04	noarch	linux	< 6.2.0-25.25	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< any	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< any	UNKNOWN
ubuntu	23.04	noarch	linux-aws	< 6.2.0-1007.7	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< any	UNKNOWN
ubuntu	22.04	noarch	linux-aws-6.2	< 6.2.0-1007.7~22.04.1	UNKNOWN
ubuntu	20.04	noarch	linux-azure	< any	UNKNOWN
ubuntu	22.04	noarch	linux-azure	< any	UNKNOWN