Vulnerability Description
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian | Debian Linux | 10.0 |
| Linux | Linux Kernel | >= 4.14, < 4.14.303 |
Related Weaknesses (CWE)
References
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queMailing ListPatchVendor Advisory
- https://github.com/torvalds/linux/commit/56b88b50565cd8b946a2d00b0c83927b7ebb055Patch
- https://github.com/torvalds/linux/commit/becf9e5d553c2389d857a3c178ce80fdb34a02ePatch
- https://lists.debian.org/debian-lts-announce/2023/05/msg00006.htmlMailing ListThird Party Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/tree/queMailing ListPatchVendor Advisory
- https://github.com/torvalds/linux/commit/56b88b50565cd8b946a2d00b0c83927b7ebb055Patch
- https://github.com/torvalds/linux/commit/becf9e5d553c2389d857a3c178ce80fdb34a02ePatch
- https://lists.debian.org/debian-lts-announce/2023/05/msg00006.htmlMailing ListThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-US Government Resource
FAQ
What is CVE-2023-0266?
CVE-2023-0266 is a vulnerability with a CVSS score of 7.9 (HIGH). A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a privil...
How severe is CVE-2023-0266?
CVE-2023-0266 has been rated HIGH with a CVSS base score of 7.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-0266?
Check the references section above for vendor advisories and patch information. Affected products include: Debian Debian Linux, Linux Linux Kernel.