An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udf_put_super and udf_close_lvid functions in fs/udf/super.c. NOTE: the suse.com reference has a different perspective about this.
References
| Link | Resource |
|---|---|
| https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-37454 | |
| https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6f861765464f43a71462d52026fbddfc858239a5 | |
| https://lore.kernel.org/all/00000000000056e02f05dfb6e11a%40google.com/T/ | |
| https://syzkaller.appspot.com/bug?extid=26873a72980f8fa8bc55 | Exploit Mailing List Third Party Advisory |
| https://syzkaller.appspot.com/bug?extid=60864ed35b1073540d57 | Exploit Mailing List Third Party Advisory |
| https://syzkaller.appspot.com/bug?extid=61564e5023b7229ec85d | Exploit Mailing List Third Party Advisory |
Configurations
History
25 Mar 2024, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Nov 2023, 04:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
07 Sep 2023, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| Summary | An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udf_put_super and udf_close_lvid functions in fs/udf/super.c. NOTE: the suse.com reference has a different perspective about this. |
12 Jul 2023, 13:45
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CWE | CWE-416 | |
| CPE | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| First Time |
Linux
Linux linux Kernel |
|
| References | (MISC) https://syzkaller.appspot.com/bug?extid=26873a72980f8fa8bc55 - Exploit, Mailing List, Third Party Advisory | |
| References | (MISC) https://syzkaller.appspot.com/bug?extid=60864ed35b1073540d57 - Exploit, Mailing List, Third Party Advisory | |
| References | (MISC) https://lore.kernel.org/all/00000000000056e02f05dfb6e11a@google.com/T/ - Exploit, Mailing List, Vendor Advisory | |
| References | (MISC) https://syzkaller.appspot.com/bug?extid=61564e5023b7229ec85d - Exploit, Mailing List, Third Party Advisory |
06 Jul 2023, 17:44
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-07-06 17:15
Updated : 2024-03-25 01:15
NVD link : CVE-2023-37454
Mitre link : CVE-2023-37454
CVE.ORG link : CVE-2023-37454
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free