← back
CVE-2023-0266

Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel

CVSS 7.9 HIGHEPSS 3.7%● KEVCWE-416
In short

A memory vulnerability in the Linux Kernel's ALSA audio system allows an attacker with basic user privileges to access and modify memory that has already been freed, potentially gaining full system control (root access).

Technical detail

A use-after-free vulnerability in SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 ioctl handlers lacks proper synchronization, allowing a local unprivileged user to trigger a race condition and access freed kernel memory. Successful exploitation leads to arbitrary code execution with kernel privileges (ring0), enabling privilege escalation from user to root.

Summary generated and translated by AI from the official description.
A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
Affected products
Linux · Linux Kernel
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →