Use-after-free in Scipy - CVE-2023-29824

Vulnerability identifier: #VU78290

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-29824

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in Py_FindObjects() function. A local user can trigger a use-after-free error and crash the application.

Scipy
Amazon Linux AMI
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Manager Proxy
SUSE Linux Enterprise Micro
SUSE Package Hub 15
HPC Module
openSUSE Leap
Ubuntu
Red Hat OpenShift Container Platform
Oracle Business Intelligence Enterprise Edition
python3-scipy (Ubuntu package)
crun-wasm (Red Hat package)
toolbox (Red Hat package)
wasmedge (Red Hat package)
golang-github-prometheus-promu (Red Hat package)
coreos-installer (Red Hat package)
butane (Red Hat package)
containernetworking-plugins (Red Hat package)
runc (Red Hat package)
python-scipy-debuginfo
python-scipy_1_2_0-gnu-hpc-debuginfo
python3-scipy_1_2_0-gnu-hpc-debuginfo
python3-scipy_1_2_0-gnu-hpc
python-scipy_1_2_0-gnu-hpc-debugsource
python3-scipy-debuginfo
python3-scipy-gnu-hpc
python-scipy_1_3_3-gnu-hpc-debugsource
python3-scipy_1_3_3-gnu-hpc-debuginfo
python3-scipy_1_3_3-gnu-hpc
python-scipy-debugsource
python3-scipy
scipy
google-benchmark (Red Hat package)
crun (Red Hat package)
skopeo (Red Hat package)
spdlog (Red Hat package)
gtest (Red Hat package)
cri-tools (Red Hat package)
cri-o (Red Hat package)
buildah (Red Hat package)
containers-common (Red Hat package)
conmon (Red Hat package)
nmstate (Red Hat package)
haproxy (Red Hat package)
ignition (Red Hat package)
container-selinux (Red Hat package)
kata-containers (Red Hat package)
catch (Red Hat package)
podman (Red Hat package)
openshift-kuryr (Red Hat package)
openshift4-aws-iso (Red Hat package)
openshift-ansible (Red Hat package)
openshift-clients (Red Hat package)
openshift (Red Hat package)
rust-afterburn (Red Hat package)
kernel (Red Hat package)
kernel-rt (Red Hat package)
fmt (Red Hat package)
ovn23.09 (Red Hat package)
IBM Business Automation Workflow

Install updates from vendor's website.

Scipy - update to 1.8.0
Red Hat OpenShift Container Platform - addressed in versions 4.13.17, 4.14.0
python3-scipy (Ubuntu package) - addressed in versions Ubuntu Pro, 1.8.1-10ubuntu0.22.10.1
crun-wasm (Red Hat package) - addressed in versions 0.0-3.rhaos4.14.el8, 1.8.5-3.rhaos4.14.el9
toolbox (Red Hat package) - update to 0.1.2-1.rhaos4.14.el9
wasmedge (Red Hat package) - update to 0.12.1-2.rhaos4.14.el9
golang-github-prometheus-promu (Red Hat package) - update to 0.15.0-15.1.gitd5383c5.el8
coreos-installer (Red Hat package) - addressed in versions 0.17.0-1.rhaos4.14.el8, 0.17.0-1.rhaos4.14.el9
butane (Red Hat package) - update to 0.19.0-1.1.rhaos4.14.el8
containernetworking-plugins (Red Hat package) - update to 1.0.1-11.1.rhaos4.14.el8
runc (Red Hat package) - addressed in versions 1.1.9-2.1.rhaos4.14.el8, 1.1.9-2.1.rhaos4.14.el9
python-scipy-debuginfo - update to 1.2.0-150100.4.6.1
python-scipy_1_2_0-gnu-hpc-debuginfo - update to 1.2.0-150100.4.6.1
python3-scipy_1_2_0-gnu-hpc-debuginfo - update to 1.2.0-150100.4.6.1
python3-scipy_1_2_0-gnu-hpc - update to 1.2.0-150100.4.6.1
python-scipy_1_2_0-gnu-hpc-debugsource - update to 1.2.0-150100.4.6.1
python3-scipy-debuginfo - update to 1.3.3-150200.5.3.1
python3-scipy-gnu-hpc - update to 1.3.3-150200.5.3.1
python-scipy_1_3_3-gnu-hpc-debugsource - update to 1.3.3-150200.5.3.1
python3-scipy_1_3_3-gnu-hpc-debuginfo - update to 1.3.3-150200.5.3.1
python3-scipy_1_3_3-gnu-hpc - update to 1.3.3-150200.5.3.1
python-scipy-debugsource - update to 1.3.3-150200.5.3.1
python3-scipy - update to 1.3.3-150200.5.3.1
scipy - update to 1.7.0-3
google-benchmark (Red Hat package) - update to 1.8.2-1.el9
crun (Red Hat package) - addressed in versions 1.9.2-1.rhaos4.14.el8, 1.9.2-1.rhaos4.14.el9
skopeo (Red Hat package) - addressed in versions 1.11.2-10.1.rhaos4.14.el8, 1.11.2-10.1.rhaos4.14.el9
spdlog (Red Hat package) - update to 1.12.0-1.rhaos4.14.el9
gtest (Red Hat package) - update to 1.13.0-1.el9
cri-tools (Red Hat package) - addressed in versions 1.27.0-2.1.el8, 1.27.0-2.1.el9
cri-o (Red Hat package) - addressed in versions 1.27.1-8.1.rhaos4.14.git3fecb83.el8, 1.27.1-8.1.rhaos4.14.git3fecb83.el9
buildah (Red Hat package) - addressed in versions 1.29.1-10.1.rhaos4.14.el8, 1.29.1-10.1.rhaos4.14.el9
containers-common (Red Hat package) - update to 1-51.rhaos4.14.el8
conmon (Red Hat package) - addressed in versions 2.1.7-3.1.rhaos4.14.el8, 2.1.7-3.1.rhaos4.14.el9
nmstate (Red Hat package) - update to 2.2.12-1.rhaos4.14.el8
haproxy (Red Hat package) - update to 2.6.13-1.rhaos4.14.el8
ignition (Red Hat package) - update to 2.16.2-1.1.rhaos4.14.el9
container-selinux (Red Hat package) - addressed in versions 2.221.0-1.rhaos4.14.el8, 2.221.0-2.rhaos4.14.el9
kata-containers (Red Hat package) - update to 3.1.3-4.rhaos4.14.el9
catch (Red Hat package) - update to 3.3.2-1.el9
podman (Red Hat package) - addressed in versions 4.4.1-10.1.rhaos4.14.el8, 4.4.1-10.1.rhaos4.14.el9
openshift-kuryr (Red Hat package) - update to 4.14.0-202309272140.p0.g8926a29.assembly.stream.el8
openshift4-aws-iso (Red Hat package) - update to 4.14.0-202309272140.p0.gd2acdd5.assembly.stream.el8
openshift-ansible (Red Hat package) - addressed in versions 4.14.0-202310062327.p0.gf781421.assembly.stream.el8, 4.14.0-202310062327.p0.gf781421.assembly.stream.el9
openshift-clients (Red Hat package) - addressed in versions 4.14.0-202310191146.p0.g0c63f9d.assembly.stream.el8, 4.14.0-202310191146.p0.g0c63f9d.assembly.stream.el9
openshift (Red Hat package) - addressed in versions 4.14.0-202310210404.p0.gf67aeb3.assembly.stream.el8, 4.14.0-202310210404.p0.gf67aeb3.assembly.stream.el9
rust-afterburn (Red Hat package) - update to 5.4.3-1.rhaos4.14.el9
kernel (Red Hat package) - update to 5.14.0-284.36.1.el9_2
kernel-rt (Red Hat package) - update to 5.14.0-284.36.1.rt14.321.el9_2
fmt (Red Hat package) - update to 9.1.0-1.el9
IBM Business Automation Workflow - update to 23.0.2 IF001
ovn23.09 (Red Hat package) - update to 23.09.0-37.el9fdp

• https://github.com/scipy/scipy/issues/14713
• http://www.square16.org/achievement/cve-2023-29824/
• https://github.com/scipy/scipy/pull/15013
• https://github.com/scipy/scipy/issues/14713#issuecomment-1629468565

• Use-after-free in SciPy
• Ubuntu update for scipy
• SUSE update for python-scipy
• SUSE update for python-scipy
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.13
• Multiple vulnerabilities in OpenShift Container Platform 4.14
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in Oracle Business Intelligence Enterprise Edition
• Amazon Linux AMI update for scipy