Vulnerability identifier: #VU90751

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52699

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the block_end(), get_branch(), get_block() and find_shared() functions in fs/sysv/itree.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/13b33feb2ebddc2b1aa607f553566b18a4af1d76
http://git.kernel.org/stable/c/1b4fe801b5bedec2b622ddb18e5c9bf26c63d79f
http://git.kernel.org/stable/c/674c1c4229e743070e09db63a23442950ff000d1
http://git.kernel.org/stable/c/fd203d2c671bdee9ab77090ff394d3b71b627927
http://git.kernel.org/stable/c/53cb1e52c9db618c08335984d1ca80db220ccf09
http://git.kernel.org/stable/c/89e8524135a3902e7563a5a59b7b5ec1bf4904ac
http://git.kernel.org/stable/c/a69224223746ab96d43e5db9d22d136827b7e2d3
http://git.kernel.org/stable/c/f123dc86388cb669c3d6322702dc441abc35c31e

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.