Use-after-free in Linux kernel - CVE-2023-52483

Vulnerability identifier: #VU90248

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-52483

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the mctp_route_lookup() function in net/mctp/route.c. A local user can escalate privileges on the system.

Linux kernel
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Public Cloud Module
openSUSE Leap
kernel-syms-azure
gfs2-kmp-azure-debuginfo
kernel-source-azure
kernel-devel-azure
kernel-azure-vdso
kernel-azure-vdso-debuginfo
kernel-azure
kernel-azure-optional-debuginfo
kselftests-kmp-azure
kernel-azure-devel
kernel-azure-debugsource
reiserfs-kmp-azure-debuginfo
ocfs2-kmp-azure
kernel-azure-livepatch-devel
cluster-md-kmp-azure
reiserfs-kmp-azure
kernel-azure-devel-debuginfo
cluster-md-kmp-azure-debuginfo
kselftests-kmp-azure-debuginfo
gfs2-kmp-azure
ocfs2-kmp-azure-debuginfo
kernel-azure-optional
dlm-kmp-azure
dlm-kmp-azure-debuginfo
kernel-azure-extra-debuginfo
kernel-azure-debuginfo
kernel-azure-extra

Install update from vendor's website.

Linux kernel - addressed in versions 5.15.137, 6.1.59, 6.5.8, 6.6
kernel-syms-azure - update to 6.4.0-150600.8.5.1
gfs2-kmp-azure-debuginfo - update to 6.4.0-150600.8.5.4
kernel-source-azure - update to 6.4.0-150600.8.5.4
kernel-devel-azure - update to 6.4.0-150600.8.5.4
kernel-azure-vdso - update to 6.4.0-150600.8.5.4
kernel-azure-vdso-debuginfo - update to 6.4.0-150600.8.5.4
kernel-azure - update to 6.4.0-150600.8.5.4
kernel-azure-optional-debuginfo - update to 6.4.0-150600.8.5.4
kselftests-kmp-azure - update to 6.4.0-150600.8.5.4
kernel-azure-devel - update to 6.4.0-150600.8.5.4
kernel-azure-debugsource - update to 6.4.0-150600.8.5.4
reiserfs-kmp-azure-debuginfo - update to 6.4.0-150600.8.5.4
ocfs2-kmp-azure - update to 6.4.0-150600.8.5.4
kernel-azure-livepatch-devel - update to 6.4.0-150600.8.5.4
cluster-md-kmp-azure - update to 6.4.0-150600.8.5.4
reiserfs-kmp-azure - update to 6.4.0-150600.8.5.4
kernel-azure-devel-debuginfo - update to 6.4.0-150600.8.5.4
cluster-md-kmp-azure-debuginfo - update to 6.4.0-150600.8.5.4
kselftests-kmp-azure-debuginfo - update to 6.4.0-150600.8.5.4
gfs2-kmp-azure - update to 6.4.0-150600.8.5.4
ocfs2-kmp-azure-debuginfo - update to 6.4.0-150600.8.5.4
kernel-azure-optional - update to 6.4.0-150600.8.5.4
dlm-kmp-azure - update to 6.4.0-150600.8.5.4
dlm-kmp-azure-debuginfo - update to 6.4.0-150600.8.5.4
kernel-azure-extra-debuginfo - update to 6.4.0-150600.8.5.4
kernel-azure-debuginfo - update to 6.4.0-150600.8.5.4
kernel-azure-extra - update to 6.4.0-150600.8.5.4

• https://git.kernel.org/stable/c/6c52b12159049046483fdb0c411a0a1869c41a67
• https://git.kernel.org/stable/c/1db0724a01b558feb1ecae551782add1951a114a
• https://git.kernel.org/stable/c/2405f64a95a7a094eb24cba9bcfaffd1ea264de4
• https://git.kernel.org/stable/c/5093bbfc10ab6636b32728e35813cbd79feb063c
• https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.137
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.59
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.8
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6

• Use-after-free in Linux kernel mctp
• SUSE update for the Linux Kernel