Vulnerability identifier: #VU93858

Vulnerability risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52646

CWE-ID: CWE-476

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to NULL pointer dereference within the aio_ring_mremap() function in fs/aio.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/808f1e4b5723ae4eda724d2ad6f6638905eefd95
http://git.kernel.org/stable/c/d8dca1bfe9adcae38b35add64977818c0c13dd22
http://git.kernel.org/stable/c/4326d0080f7e84fba775da41d158f46cf9d3f1c2
http://git.kernel.org/stable/c/c261f798f7baa8080cf0214081d43d5f86bb073f
http://git.kernel.org/stable/c/178993157e8c50aef7f35d7d6d3b44bb428199e1
http://git.kernel.org/stable/c/af126acf01a12bdb04986fd26fc2eb3b40249e0d
http://git.kernel.org/stable/c/81e9d6f8647650a7bead74c5f926e29970e834d1

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.