CVE-2023-2235
Summary
| CVE | CVE-2023-2235 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2023-05-01 13:15:00 UTC |
|---|
| Updated | 2023-08-25 15:24:00 UTC |
|---|
| Description | A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation.
The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but remove_on_exec made it possible to call list_del_event() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability.
We recommend upgrading past commit fd0815f632c24878e325821943edccc7fde947a2. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| CVE-2023-2235 Linux Kernel Vulnerability in NetApp Products | NetApp Product Security |
MISC |
security.netapp.com |
|
| kernel/git/torvalds/linux.git - Linux kernel source tree |
MISC |
git.kernel.org |
|
| kernel.dance/fd0815f632c24878e325821943edccc7fde947a2 |
MISC |
kernel.dance |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160806 Oracle Enterprise Linux Security Update for kernel (ELSA-2023-3723)
- 160859 Oracle Enterprise Linux Security Update for kernel (ELSA-2023-4517)
- 182346 Debian Security Update for linux (CVE-2023-2235)
- 199422 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6175-1)
- 199437 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6186-1)
- 199670 Ubuntu Security Notification for Linux kernel Vulnerabilities (USN-6300-1)
- 199764 Ubuntu Security Notification for Linux kernel (OEM) Vulnerabilities (USN-6385-1)
- 241732 Red Hat Update for kpatch-patch (RHSA-2023:3705)
- 241733 Red Hat Update for kernel (RHSA-2023:3723)
- 241740 Red Hat Update for kernel-rt (RHSA-2023:3708)
- 241823 Red Hat Update for kernel (RHSA-2023:4137)
- 241830 Red Hat Update for kernel-rt (RHSA-2023:4138)
- 241927 Red Hat Update for kernel-rt (RHSA-2023:4541)
- 241936 Red Hat Update for kernel (RHSA-2023:4517)
- 242151 Red Hat Update for kernel security (RHSA-2023:5627)
- 355178 Amazon Linux Security Advisory for kernel : ALAS2023-2023-148
- 355358 Amazon Linux Security Advisory for kernel : ALAS2KERNEL-5.15-2023-019
- 755851 SUSE Enterprise Linux Security Update for the linux kernel (SUSE-SU-2023:2646-1)
- 906906 Common Base Linux Mariner (CBL-Mariner) Security Update for kernel (26389-1)
- 941166 AlmaLinux Security Update for kernel (ALSA-2023:3723)
- 941167 AlmaLinux Security Update for kernel-rt (ALSA-2023:3708)
- 941227 AlmaLinux Security Update for kernel (ALSA-2023:4517)
- 941228 AlmaLinux Security Update for kernel-rt (ALSA-2023:4541)
- 961032 Rocky Linux Security Update for kernel (RLSA-2023:4517)
- 961046 Rocky Linux Security Update for kernel-rt (RLSA-2023:4541)
