AZL-31853
Dashboard / Vulnerabilities / AZL-31853
Summary: CVE-2023-1192 affecting package kernel for versions less than 5.15.137.1-1
Details: A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are still local variable points to the memory region, and if the system call frees it faster than CIFS uses it, CIFS will access a free memory region, leading to a denial of service.
References: https://nvd.nist.gov/vuln/detail/CVE-2023-1192
Affected packages
Package
Name: kernel
Purl: pkg:rpm/azure-linux/kernel
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -5.15.137.1-1
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
