CVE-2023-5345CWE-416

Use-after-free in Linux kernel's fs/smb/client component

High · published October 3, 2023

CVSS v3.1
7.8
EPSS
0%
Percentile
40.8
In the wild
Unconfirmed
What it is

A use-after-free vulnerability in the Linux kernel's fs/smb/client component can be exploited to achieve local privilege escalation.

In case of an error in smb3_fs_context_parse_param, ctx->password was freed but the field was not set to NULL which could lead to double free.

We recommend upgrading past commit e6e43b8aa7cd3c3af686caf0c2e11819a886d705.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00485 · 40.8th percentile
Weakness
CWE-416 · Use After Free
Published
2023-10-03T02:33Z
EPSS history
Timeline
  • 03 OCT 02:33Z
    Use-after-free in Linux kernel's fs/smb/client component
    cvelistv5