CVE-2023-37454 Use after free in n/a
A crafted UDF filesystem image triggers a use-after-free in the Linux kernel, potentially allowing local attackers to execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-37454?
CVE-2023-37454 is a medium-severity use after free vulnerability in Linux kernel, published on 6 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udf_put_super and udf_close_lvid functions in fs/udf/super.c. NOTE: the suse.com reference has a different perspective about this.
Weakness: CWE-416
Which versions are affected by CVE-2023-37454?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2023-37454?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-37454 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-37454 exists.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-27387, DEBIAN-CVE-2023-37454, GHSA-p2p8-49mr-gp6c, ROOT-OS-DEBIAN-11-CVE-2023-37454, ROOT-OS-DEBIAN-12-CVE-2023-37454, ROOT-OS-DEBIAN-13-CVE-2023-37454.