CVE-2023-35823: Use After Free
An issue was discovered in the Linux kernel before 6.3.2. A use-after-free was found in saa7134finidev in drivers/media/pci/saa7134/saa7134-core.c.
Other sources
Linux Kernel could allow a local authenticated attacker to execute arbitrary code on the system, caused by a use-after-free flaw in the saa7134finidev function in drivers/media/pci/saa7134/saa7134-core.c. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.4 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.3.2Patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=30cf57da176cca80f11df0d9b7f71581fe601389
Event History
Frequently Asked Questions
What is the severity of CVE-2023-35823?
CVE-2023-35823 has a moderate severity level due to the potential for a use-after-free vulnerability in the Linux kernel.
How do I fix CVE-2023-35823?
To fix CVE-2023-35823, upgrade the Linux kernel to version 6.4 or later.
Which versions of the Linux kernel are affected by CVE-2023-35823?
CVE-2023-35823 affects Linux kernel versions prior to 6.3.2.
Are there any specific products impacted by CVE-2023-35823?
Yes, IBM Security Verify Governance and Identity Manager components up to version ISVG 10.0.2 are affected.
What is a use-after-free vulnerability in the context of CVE-2023-35823?
A use-after-free vulnerability occurs when a program continues to use memory after it has been freed, potentially leading to arbitrary code execution.