Race condition in Linux kernel - CVE-2023-3397

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU83850

Race condition in Linux kernel - CVE-2023-3397

Published: December 4, 2023


Vulnerability identifier: #VU83850
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-3397
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition between the lmLogClose() and txEnd() function in JFS. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.


Affected software

Linux kernel
Amazon Linux AMI
kernel

How to mitigate CVE-2023-3397

Install updates from vendor's website.

kernel - update to 4.14.328-174.540

External References

Related Security Bulletins