#VU89982 Memory leak in Linux kernel - CVE-2023-52698

Vulnerability identifier: #VU89982

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52698

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the netlbl_calipso_ops_register(), netlbl_calipso_add_pass() and netlbl_calipso_genl_init() functions in net/netlabel/netlabel_calipso.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/9a8f811a146aa2a0230f8edb2e9f4b6609aab8da
https://git.kernel.org/stable/c/36e19f84634aaa94f543fedc0a07588949638d53
https://git.kernel.org/stable/c/44a88650ba55e6a7f2ec485d2c2413ba7e216f01
https://git.kernel.org/stable/c/a4529a08d3704c17ea9c7277d180e46b99250ded
https://git.kernel.org/stable/c/321b3a5592c8a9d6b654c7c64833ea67dbb33149
https://git.kernel.org/stable/c/408bbd1e1746fe33e51f4c81c2febd7d3841d031
https://git.kernel.org/stable/c/f14d36e6e97fe935a20e0ceb159c100f90b6627c
https://git.kernel.org/stable/c/ec4e9d630a64df500641892f4e259e8149594a99

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.