[email protected]CVE-2023-28466

HistoryMar 16, 2023 - 12:15 a.m.

CVE-2023-28466

2023-03-1600:15:11

CWE-476

[email protected]

web.nvd.nist.gov

114

cve-2023-28466

linux kernel

race condition

net/tls/tls_main.c

nvd

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference).

Affected configurations

NVD

Node

linuxlinux_kernelRange4.13–5.4.240

linuxlinux_kernelRange5.5–5.10.177

linuxlinux_kernelRange5.11–5.15.105

linuxlinux_kernelRange5.16–6.1.20

linuxlinux_kernelRange6.2–6.2.7

Node

netapph300sMatch-

netapph410cMatch-

netapph410sMatch-

netapph500sMatch-

netapph700sMatch-

Node

debiandebian_linuxMatch10.0

CPENameOperatorVersion
linux:linux_kernellinux linux kernelle5.4.240
linux:linux_kernellinux linux kernellt5.10.177
linux:linux_kernellinux linux kernellt5.15.105
linux:linux_kernellinux linux kernellt6.1.20
linux:linux_kernellinux linux kernellt6.2.7

CPE	Name	Operator	Version
linux:linux_kernel	linux linux kernel	le	5.4.240
linux:linux_kernel	linux linux kernel	lt	5.10.177
linux:linux_kernel	linux linux kernel	lt	5.15.105
linux:linux_kernel	linux linux kernel	lt	6.1.20
linux:linux_kernel	linux linux kernel	lt	6.2.7