Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2023-52907 |
CWE-ID | CWE-416 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software Subscribe |
Linux kernel Operating systems & Components / Operating system |
Vendor | Linux Foundation |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU96335
Risk: Low
CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-52907
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the pn533_usb_send_ack(), pn533_usb_send_frame(), pn533_acr122_poweron_rdr() and pn533_usb_probe() functions in drivers/nfc/pn533/usb.c. A local user can escalate privileges on the system.
MitigationInstall update from vendor's website.
Vulnerable software versionsLinux kernel: All versions
External linkshttp://git.kernel.org/stable/c/35529d6b827eedb6bf7e81130e4b7e0aba9e58d2
http://git.kernel.org/stable/c/321db5131c92983dac4f3338e8fbb6df214238c0
http://git.kernel.org/stable/c/9424d2205fe94a095fb9365ec0c6137f0b394a2b
http://git.kernel.org/stable/c/0ca78c99656f5c448567db1e148367aa3b01c80a
http://git.kernel.org/stable/c/39ae73e581112cfe27ba50aecb1c891ce57cecb1
http://git.kernel.org/stable/c/8998db5021a28ad67aa8d627bdb4226e4046ccc4
http://git.kernel.org/stable/c/9dab880d675b9d0dd56c6428e4e8352a3339371d
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.