#VU90751 Improper locking in Linux kernel - CVE-2023-52699

Vulnerability identifier: #VU90751

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-52699

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the block_end(), get_branch(), get_block() and find_shared() functions in fs/sysv/itree.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/13b33feb2ebddc2b1aa607f553566b18a4af1d76
https://git.kernel.org/stable/c/1b4fe801b5bedec2b622ddb18e5c9bf26c63d79f
https://git.kernel.org/stable/c/674c1c4229e743070e09db63a23442950ff000d1
https://git.kernel.org/stable/c/fd203d2c671bdee9ab77090ff394d3b71b627927
https://git.kernel.org/stable/c/53cb1e52c9db618c08335984d1ca80db220ccf09
https://git.kernel.org/stable/c/89e8524135a3902e7563a5a59b7b5ec1bf4904ac
https://git.kernel.org/stable/c/a69224223746ab96d43e5db9d22d136827b7e2d3
https://git.kernel.org/stable/c/f123dc86388cb669c3d6322702dc441abc35c31e

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.