CVE-2023-3141: A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel

High severity · published Jun 9, 2023

CVE-2023-3141

A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel

7.1

CVSS

0.4%

EPSS

On KEV

Description

A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This flaw allows a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 38% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Kernel · Linux

Kenrel version prior to Kernel 6.4-rc1 · source: vendor, NVD

Debian Linux · Debian

10.0 · source: NVD

Hci Baseboard Management Controller · Netapp

h300s; h410c; h410s; h500s; h700s · source: NVD

SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens

before V1.1 · source: CISA

Affected product

Kernel

Linux

All Kernel CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-3141

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-3141

Third Party Advisory

https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.3.4

Mailing List

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=63264422785021704c39b38f65a78ab9e4a186d7

Mailing List

https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html

Mailing List

https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html

lore.kernel.org

https://lore.kernel.org/lkml/CAPDyKFoV9aZObZ5GBm0U_-UVeVkBN_rAG-kH3BKoP4EXdYM4bw%40mail.gmail.com/t/

Third Party Advisory

https://security.netapp.com/advisory/ntap-20230706-0004/