CVE-2023-52880: tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc
In the Linux kernel, the following vulnerability has been resolved:
tty: ngsm: require CAPNETADMIN to attach NGSM0710 ldisc
Any unprivileged user can attach NGSM0710 ldisc, but it requires CAPNETADMIN to create a GSM network anyway.
Require initial namespace CAPNETADMIN to do that.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
tty: ngsm: require CAPNETADMIN to attach NGSM0710 ldisc
The Linux kernel CVE team has assigned CVE-2023-52880 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024052422-CVE-2023-52880-d2ff@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.312 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.274 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.215 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.155 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.86 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2023-52880
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52880?
CVE-2023-52880 has a high severity due to the potential for unauthorized users to attach the N_GSM0710 ldisc.
How do I fix CVE-2023-52880?
To fix CVE-2023-52880, ensure that you update your kernel to a fixed version such as 4.19.312, 5.4.274, 5.10.215, 5.15.155, 6.1.86, or 6.6.
Which software is affected by CVE-2023-52880?
CVE-2023-52880 affects certain versions of the Linux kernel, including various Red Hat and Debian packages.
What are the risks of not addressing CVE-2023-52880?
Not addressing CVE-2023-52880 could allow unprivileged users to exploit the vulnerability to attach the N_GSM0710 ldisc, leading to potential network security breaches.
Who should be concerned about CVE-2023-52880?
Developers, system administrators, and organizations using affected Linux kernel versions should prioritize addressing CVE-2023-52880 to safeguard their systems.