CVE-2023-1838: Use After Free
A use-after-free flaw was found in vhostnetsetbackend in drivers/vhost/net.c in virtio network subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the system, and could even lead to a kernel information leak problem.
Other sources
Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by a use-after-free flaw in the vhostnetsetbackend function in drivers/vhost/net.c in the virtio network subcomponent. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information or cause the system to crash.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1838?
CVE-2023-1838 has a high severity due to the potential for local attackers to crash systems or exploit kernel information leaks.
How do I fix CVE-2023-1838?
To fix CVE-2023-1838, update your Linux kernel to versions that are patched, such as those above 5.18 and specified remedied versions from Debian and IBM.
What are the affected systems for CVE-2023-1838?
CVE-2023-1838 affects various versions of the Linux kernel, IBM Security Verify Governance, and specific NetApp models.
What type of vulnerability is CVE-2023-1838?
CVE-2023-1838 is a use-after-free vulnerability in the Linux kernel, specifically in the vhost_net_set_backend function.
Can CVE-2023-1838 lead to remote code execution?
While CVE-2023-1838 primarily allows for system crashes and information leaks, it does not directly lead to remote code execution.