Vulnerability identifier: #VU96335

Vulnerability risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-52907

CWE-ID: CWE-416

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the pn533_usb_send_ack(), pn533_usb_send_frame(), pn533_acr122_poweron_rdr() and pn533_usb_probe() functions in drivers/nfc/pn533/usb.c. A local user can escalate privileges on the system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/35529d6b827eedb6bf7e81130e4b7e0aba9e58d2
http://git.kernel.org/stable/c/321db5131c92983dac4f3338e8fbb6df214238c0
http://git.kernel.org/stable/c/9424d2205fe94a095fb9365ec0c6137f0b394a2b
http://git.kernel.org/stable/c/0ca78c99656f5c448567db1e148367aa3b01c80a
http://git.kernel.org/stable/c/39ae73e581112cfe27ba50aecb1c891ce57cecb1
http://git.kernel.org/stable/c/8998db5021a28ad67aa8d627bdb4226e4046ccc4
http://git.kernel.org/stable/c/9dab880d675b9d0dd56c6428e4e8352a3339371d

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.