#VU89899 Permissions, Privileges, and Access Controls in Linux kernel - CVE-2023-52880

Vulnerability identifier: #VU89899

Vulnerability risk: Low

CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52880

CWE-ID: CWE-264

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to bypass implemented security restrictions.

The vulnerability exists due to missing permissions checks within the gsmld_open() function in drivers/tty/n_gsm.c. A local user with CAP_NET_ADMIN capability can create a GSM network.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/7d303dee473ba3529d75b63491e9963342107bed
https://git.kernel.org/stable/c/7a529c9023a197ab3bf09bb95df32a3813f7ba58
https://git.kernel.org/stable/c/ada28eb4b9561aab93942f3224a2e41d76fe57fa
https://git.kernel.org/stable/c/2d154a54c58f9c8375bfbea9f7e51ba3bfb2e43a
https://git.kernel.org/stable/c/2b85977977cbd120591b23c2450e90a5806a7167
https://git.kernel.org/stable/c/67c37756898a5a6b2941a13ae7260c89b54e0d88

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.