← Back

CVE-2023-2236

nvd nist
Published: May 1, 2023Modified: Jun 17, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

A use-after-free vulnerability in the Linux Kernel io_uring subsystem can be exploited to achieve local privilege escalation. Both io_install_fixed_file and its callers call fput in a file in case of an error, causing a reference underflow which leads to a use-after-free vulnerability. We recommend upgrading past commit 9d94c04c0db024922e886c9fd429659f22f48ea4.

Affected (6)

Linux
1 product
Linux Kernel
Netapp
1 product
Hci Baseboard Management Controller
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Linux Kernel
From 5.19 to 6.0.11
Configuration B
5 vulnerable
Vulnerable SoftwareAffected Versions
Netapp
Hci Baseboard Management Controller
Version h300s
Hci Baseboard Management Controller
Version h410c
Hci Baseboard Management Controller
Version h410s
Hci Baseboard Management Controller
Version h500s
Hci Baseboard Management Controller
Version h700s

Related CWEs

CWE-416
Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (6)

Source: cve-coordination@google.com
ExploitMailing ListPatch
Source: cve-coordination@google.com
ExploitPatch
Source: cve-coordination@google.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMailing ListPatch
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitPatch
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.