#VU90075 Use-after-free in Linux kernel - CVE-2023-52798

Vulnerability identifier: #VU90075

Vulnerability risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52798

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the ath11k_wmi_pdev_dfs_radar_detected_event() function in drivers/net/wireless/ath/ath11k/wmi.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/f882f51905517575c9f793a3dff567af90ef9a10
https://git.kernel.org/stable/c/426e718ce9ba60013364a54233feee309356cb82
https://git.kernel.org/stable/c/ca420ac4f9451f22347bae44b18ab47ba2c267ec
https://git.kernel.org/stable/c/1fd878e1750190a612b5de2af357cca422ec0822
https://git.kernel.org/stable/c/21ebb0aba580d347e12f01ce5f6e75044427b3d5
https://git.kernel.org/stable/c/3b6c14833165f689cc5928574ebafe52bbce5f1e

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.