CVE-2023-0266highunder attackCWE-416

CVE-2023-0266: high-severity vulnerability in Linux Kernel

Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel

Published · Updated

Follow this CVE+ Monitor Linux+ Monitor linux

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.9epss 3.7%
from disclosure to weapon405 days
Published on NVDJan 30
1st PoC+405d
CISA KEV+59d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
27 products (1,221 components)
Red Hat Enterprise Linux BaseOS EUS (v.8.6) · Red Hat Enterprise Linux BaseOS EUS (v.8.4) · Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux BaseOS EUS (v.9.0) · Red Hat Enterprise Linux BaseOS (v. 9) · and others 22
fix ↗
Not affected
3 products (46 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Action required by CISAfederal deadline: 2023-04-20

Apply updates per vendor instructions.

In short

A memory vulnerability in the Linux Kernel's ALSA audio system allows an attacker with basic user privileges to access and modify memory that has already been freed, potentially gaining full system control (root access).

Technical detail

A use-after-free vulnerability in SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 ioctl handlers lacks proper synchronization, allowing a local unprivileged user to trigger a race condition and access freed kernel memory. Successful exploitation leads to arbitrary code execution with kernel privileges (ring0), enabling privilege escalation from user to root.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:H
Affected products
Linux · Linux Kernel
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Linux Kernel

In the same product, most dangerous first.

CVE-2018-5390—Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of serviceEPSS 71.8%CVE-2023-2163CRITICALIncorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege EscalationEPSS 3.6%CVE-2022-42896HIGHInfo Leak in l2cap_core in the Linux KernelEPSS 2.5%CVE-2023-0045MEDIUMIncorrect indirect branch prediction barrier in the Linux KernelEPSS 2.4%CVE-2023-31248HIGHLinux Kernel nftables Use-After-Free Local Privilege Escalation VulnerabilityEPSS 1.9%CVE-2023-35001HIGHLinux Kernel nftables Out-Of-Bounds Read/Write VulnerabilityEPSS 1.5%