CVE-2023-3439: Use After Free
A flaw was found in the MCTP protocol in the Linux kernel. The function mctpunregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object, potentially leading to a denial of service.
Other sources
The function mctpunregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object.
References: https://github.com/torvalds/linux/commit/b561275d633bcd8e0e8055ab86f1a13df75a0269
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.18 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3439?
CVE-2023-3439 is rated as a medium severity vulnerability due to the potential for a denial of service.
How do I fix CVE-2023-3439?
To mitigate CVE-2023-3439, update to a kernel version of 5.18 or later, or apply any security patches provided by your distribution.
Which versions of the Linux kernel are affected by CVE-2023-3439?
CVE-2023-3439 affects Linux kernel versions up to and including 5.18.
What is the potential impact of CVE-2023-3439?
CVE-2023-3439 could lead to a denial of service condition due to a use-after-free error.
Is CVE-2023-3439 a widespread issue?
CVE-2023-3439 impacts various distributions of Linux, making it a notable concern for users running affected versions.