Description
A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High
Affected products
- Debian / debian_linux10.0 – 10.0
- Linux / Linux kernel2.6.39 – 4.14.316
- NetApp / hci_baseboard_management_controllerh410c – h410c
- NetApp / hci_baseboard_management_controllerh500s – h500s
- NetApp / hci_baseboard_management_controllerh700s – h700s
- NetApp / hci_baseboard_management_controllerh410s – h410s
- NetApp / hci_baseboard_management_controllerh300s – h300s
References
- MISChttps://lore.kernel.org/lkml/CAPDyKFoV9aZObZ5GBm0U_-UVeVkBN_rAG-kH3BKoP4EXdYM4bw%40mail.gmail.com/t/
- MISChttps://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.4
- MISChttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=63264422785021704c39b38f65a78ab9e4a186d7
- MISChttps://security.netapp.com/advisory/ntap-20230706-0004/
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2023/07/msg00030.html
- MAILING_LISThttps://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
Updated 17m ago · 8 sources