CVE-2023-1652: Use After Free
A use-after-free flaw was found in nfsd4sscsetupdul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel information leak problem.
Other sources
There is a use-after-free bug in nfsd4sscsetupdul() in fs/nfsd/nfs4proc.c in Linux kernel through v6.2-rc4, which allows an attacker to trigger Denial of Service.
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e6cf91b7b47ff82b624bdfe2fdcde32bb52e71dd
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 6.2
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1652?
CVE-2023-1652 has a high severity rating due to the potential for local attackers to crash the system or leak sensitive kernel information.
How do I fix CVE-2023-1652?
To fix CVE-2023-1652, update to the patched versions of the Linux Kernel, specifically versions 6.2 or any version above 5.15.91 compatible with the affected distributions.
Which systems are affected by CVE-2023-1652?
CVE-2023-1652 affects various versions of the Linux Kernel, particularly those between 5.14 and 6.1.9, including specific Red Hat and Debian distributions.
What type of vulnerability is CVE-2023-1652?
CVE-2023-1652 is a use-after-free vulnerability affecting the NFS filesystem in the Linux Kernel.
Can CVE-2023-1652 be exploited remotely?
CVE-2023-1652 is primarily a local vulnerability that can be exploited by local attackers with access to the system.