CVE-2023-45898: Use After Free
Last updated 30 August 2024
Other sources
The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extentsstatus.c, related to ext4esinsertextent.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.5.4
Event History
Frequently Asked Questions
What is CVE-2023-45898?
CVE-2023-45898 is a vulnerability in the Linux kernel before version 6.5.4 that allows for a use-after-free in fs/ext4/extents_status.c related to ext4_es_insert_extent.
How severe is CVE-2023-45898?
CVE-2023-45898 has a severity score of 7.8, which is considered high.
How do I know if my software is affected by CVE-2023-45898?
If you are using Linux kernel version before 6.5.4, your software may be affected by CVE-2023-45898.
How can I fix CVE-2023-45898?
To fix CVE-2023-45898, you should update your Linux kernel to version 6.5.4 or later.
Where can I find more information about CVE-2023-45898?
You can find more information about CVE-2023-45898 on the following references: [Reference 1](https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.5.4), [Reference 2](https://github.com/torvalds/linux/commit/768d612f79822d30a1e7d132a4d4b05337ce42ec), [Reference 3](https://lkml.org/lkml/2023/8/13/477).