CVE-2023-52566
Vulnérabilité moyenne dans Linux (Linux)
Description
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails. If the reference count hits 0 and its owner page gets unlocked, bh may be freed. However, bh->b_page is dereferenced to put the page after that, which may result in a use-after-free bug. This patch moves the release operation after unlocking and putting the page. NOTE: The function in question is only called in GC, and in combination with current userland tools, address translation using DAT does not occur in that function, so the code path that causes this issue will not be executed. However, it is possible to run that code path by intentionally modifying the userland GC library or by calling the GC ioctl directly. [konishi.ryusuke@gmail.com: NOTE added to the commit log]
Gravité et risque d'exploitation
CVE-2023-52566 obtient un score CVSS de 5.5/10, soit une gravité moyenne. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.22 %, ce qui la place devant 12.2 % des CVE référencées.
Que faire ?
- Vérifiez si Linux (versions 4.14.327, <3936e8714907cd55e37c7cc50e50229e4a9042e8, <193b5a1c6c67c36b430989dc063fe7ea4e200a33, <=6.1.*, 4.19.296, <7130a87ca32396eb9bf48b71a2d42259ae44c6c7, 5.10.198, <bb61224f6abc8e71bfdf06d7c984e23460875f5b, <980663f1d189eedafd18d80053d9cf3e2ceb5c8c, 0, 6.5.6, 6.1.56, <=5.10.*, 2.6.30, <=4.14.*, 5.4.258, 6.6, 5.15.134, <=5.4.*, <7ee29facd8a9c5a26079148e36bcf07141b3a6bc, <2.6.30, <=4.19.*, <28df4646ad8b433340772edc90ca709cdefc53e2, <fb1084e63ee56958b0a56e17a50a4fd86445b9c1, <=*, <=5.15.*, <=6.5.*, a3d93f709e893187d301aa5458b2248db9f22bd1) est présent sur votre parc.
- Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
- À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
- Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.
Références
- https://git.kernel.org/stable/c/fb1084e63ee56958b0a56e17a50a4fd86445b9c1
- https://git.kernel.org/stable/c/bb61224f6abc8e71bfdf06d7c984e23460875f5b
- https://git.kernel.org/stable/c/193b5a1c6c67c36b430989dc063fe7ea4e200a33
- https://git.kernel.org/stable/c/7130a87ca32396eb9bf48b71a2d42259ae44c6c7
- https://git.kernel.org/stable/c/3936e8714907cd55e37c7cc50e50229e4a9042e8
- https://git.kernel.org/stable/c/980663f1d189eedafd18d80053d9cf3e2ceb5c8c
- https://git.kernel.org/stable/c/28df4646ad8b433340772edc90ca709cdefc53e2
- https://git.kernel.org/stable/c/7ee29facd8a9c5a26079148e36bcf07141b3a6bc