#VU108431 Use-after-free in Linux kernel - CVE-2023-53090

Vulnerability identifier: #VU108431

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-53090

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the alloc_event_waiters() function in drivers/gpu/drm/amd/amdkfd/kfd_events.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.1, 6.1 rc1, 6.1 rc3, 6.1 rc7, 6.1.1, 6.1.2, 6.1.3, 6.1.4, 6.1.5, 6.1.6, 6.1.7, 6.1.8, 6.1.9, 6.1.10, 6.1.11, 6.1.12, 6.1.13, 6.1.14, 6.1.15, 6.1.16, 6.1.17, 6.1.18, 6.1.19, 6.1.20

---

External links
https://git.kernel.org/stable/c/2fece63b55c5d74cd6f5de51159e2cde37e10555
https://git.kernel.org/stable/c/4fc8fff378b2f2039f2a666d9f8c570f4e58352c
https://git.kernel.org/stable/c/5a3fb3b745af0ce46ec2e0c8e507bae45b937334
https://git.kernel.org/stable/c/61f306f8df0d5559659c5578cf6d95236bcdcb25
https://git.kernel.org/stable/c/6936525142a015e854d0a23e9ad9ea0a28b3843d
https://git.kernel.org/stable/c/bbf5eada4334a96e3a204b2307ff5b14dc380b0b
https://git.kernel.org/stable/c/d9923e7214a870b312bf61f6a89c7554d0966985
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.1.21

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.