Vulnerability identifier: #VU91319

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52524

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the nfc_llcp_register_device() function in net/nfc/llcp_core.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/191d87a19cf1005ecf41e1ae08d74e17379e8391
http://git.kernel.org/stable/c/dba849cc98113b145c6e720122942c00b8012bdb
http://git.kernel.org/stable/c/4837a192f6d06d5bb2f3f47d6ce5353ab69bf86b
http://git.kernel.org/stable/c/7562780e32b84196731d57dd24563546fcf6d082
http://git.kernel.org/stable/c/29c16c2bf5866326d5fbc4a537b3997fcac23391
http://git.kernel.org/stable/c/dfc7f7a988dad34c3bf4c053124fb26aa6c5f916

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.