exploitDog

CVE-2023-52502

Опубликовано: 02 мар. 2024

Источник: nvd

CVSS3: 6.3

EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved:

net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()

Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF.

Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock.

nfc_llcp_sock_get_sn() has a similar problem.

Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 3.6 (включая) до 4.19.297 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 4.20 (включая) до 5.4.259 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.5 (включая) до 5.10.199 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.11 (включая) до 5.15.136 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 5.16 (включая) до 6.1.59 (исключая)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Версия от 6.2 (включая) до 6.5.8 (исключая)

cpe:2.3:o:linux:linux_kernel:6.6:rc1:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:6.6:rc2:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:6.6:rc3:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:6.6:rc4:*:*:*:*:*:*

cpe:2.3:o:linux:linux_kernel:6.6:rc5:*:*:*:*:*:*

EPSS

Процентиль: 0%

0.00006

Низкий

6.3 Medium

CVSS3

Дефекты

CWE-362

Связанные уязвимости

CVE-2023-52502

CVSS3: 6.3

ubuntu

больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear.

CVE-2023-52502

CVSS3: 7.1

redhat

больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear.

CVE-2023-52502

CVSS3: 6.3

debian

больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: n ...

GHSA-g754-37wh-7wv7

CVSS3: 6.3

github

больше 1 года назад

In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF. Getting a reference on the socket found in a lookup while holding a lock should happen before releasing the lock. nfc_llcp_sock_get_sn() has a similar problem. Finally nfc_llcp_recv_snl() needs to make sure the socket found by nfc_llcp_sock_from_sn() does not disappear.

BDU:2024-07820

CVSS3: 8.8

fstec

почти 2 года назад

Уязвимость компонента nfc ядра операционной системы Linux, позволяющая нарушителю получить несанкционированный доступ к конфиденциальной информации в системе

EPSS

Процентиль: 0%

0.00006

Низкий

6.3 Medium

CVSS3

Дефекты

CWE-362