CVE-2023-1838CWE-416

CVE-2023-1838

High · published April 5, 2023

CVSS v3.1
7.1
EPSS
0%
Percentile
15.5
In the wild
Unconfirmed
What it is

A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00251 · 15.5th percentile
Weakness
CWE-416 · Use After Free
Published
2023-04-05T23:15Z
Affected products (11)
ProductVersionsFixed in
linux/linux_kernel≥ 4.13, < 4.14.3174.14.317
linux/linux_kernel≥ 4.15, < 4.19.2454.19.245
linux/linux_kernel≥ 4.20, < 5.4.1965.4.196
linux/linux_kernel≥ 5.5, < 5.10.1185.10.118
linux/linux_kernel≥ 5.11, < 5.15.425.15.42
linux/linux_kernel≥ 5.16, < 5.17.105.17.10
netapp/h300sall versions—
netapp/h410call versions—
netapp/h410sall versions—
netapp/h500sall versions—
netapp/h700sall versions—
References (4)
https://lore.kernel.org/netdev/20220516084213.26854-1-jasowang%40redhat.com/T/ · [email protected]https://security.netapp.com/advisory/ntap-20230517-0003/ · [email protected]https://lore.kernel.org/netdev/20220516084213.26854-1-jasowang%40redhat.com/T/ · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20230517-0003/ · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 05 APR 00:00Z
    A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget
    cvelistv5