CVE-2023-6932 Use-after-free in Linux kernel's ipv4: igmp component

2023-12-1914:09:15

CWE-416

Google

www.cve.org

linux kernel

ipv4

igmp

use-after-free

vulnerability

local privilege escalation

race condition

timer

rcu

thread

upgrade

commit

e2b706c691905fe78468c361aaabc719d0a496f1

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A use-after-free vulnerability in the Linux kernel’s ipv4: igmp component can be exploited to achieve local privilege escalation.

A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another thread.

We recommend upgrading past commit e2b706c691905fe78468c361aaabc719d0a496f1.

CNA Affected

[
  {
    "vendor": "Linux",
    "product": "Kernel",
    "packageName": "kernel",
    "repo": "https://git.kernel.org",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.12",
        "lessThan": "6.7",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]