CVE-2023-52600: jfs: fix uaf in jfs_evict_inode
In the Linux kernel, the following vulnerability has been resolved:
jfs: fix uaf in jfsevictinode
When the execution of diMount(ipimap) fails, the object ipimap that has been released may be accessed in diFreeSpecial(). Asynchronous ipimap release occurs when rcucore() calls jfsfreenode().
Therefore, when diMount(ipimap) fails, sbi->ipimap should not be initialized as ipimap.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52600?
CVE-2023-52600 has a severity rating that indicates a potential risk of user-after-free vulnerabilities in the Linux kernel.
How do I fix CVE-2023-52600?
To mitigate CVE-2023-52600, update your Linux kernel to versions 5.10.223-1, 6.1.123-1, or any version that includes the relevant patches.
Which versions of the Linux kernel are affected by CVE-2023-52600?
CVE-2023-52600 affects various versions of the Linux kernel between 4.19.307 and 6.7.4, excluding certain fixed versions.
What type of vulnerability is CVE-2023-52600?
CVE-2023-52600 is a user-after-free vulnerability that can potentially lead to unauthorized access or system crashes.
What components are involved in CVE-2023-52600?
CVE-2023-52600 specifically involves the jfs (Journaled File System) component of the Linux kernel.