CVE-2023-40283CWE-416

CVE-2023-40283

High · published August 14, 2023

CVSS v3.1
7.8
EPSS
1%
Percentile
45.2
In the wild
Unconfirmed
What it is

An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10. There is a use-after-free because the children of an sk are mishandled.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00550 · 45.2th percentile
Weakness
CWE-416 · Use After Free
Published
2023-08-14T07:15Z
Affected products (15)
ProductVersionsFixed in
linux/linux_kernel≥ 3.5, < 4.14.3224.14.322
linux/linux_kernel≥ 4.15, < 4.19.2914.19.291
linux/linux_kernel≥ 4.20, < 5.4.2535.4.253
linux/linux_kernel≥ 5.5, < 5.10.1905.10.190
linux/linux_kernel≥ 5.11, < 5.15.1265.15.126
linux/linux_kernel≥ 5.16, < 6.1.456.1.45
linux/linux_kernel≥ 6.2, < 6.4.106.4.10
debian/debian_linuxall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
References (22)
http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html · [email protected]http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html · [email protected]https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.10 · [email protected]https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 · [email protected]https://github.com/torvalds/linux/commit/1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 · [email protected]https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html · [email protected]https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html · [email protected]https://security.netapp.com/advisory/ntap-20231020-0007/ · [email protected]https://www.debian.org/security/2023/dsa-5480 · [email protected]https://www.debian.org/security/2023/dsa-5492 · [email protected]http://packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html · af854a3a-2127-422b-91ae-364da2661108https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.4.10 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 · af854a3a-2127-422b-91ae-364da2661108https://github.com/torvalds/linux/commit/1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20231020-0007/ · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5480 · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2023/dsa-5492 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttps://cert-portal.siemens.com/productcert/html/ssa-806742.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 14 AUG 00:00Z
    An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_sock.c in the Linux kernel before 6.4.10
    cvelistv5