ReviewHigh

CVE-2023-2235

Linux Linux Kernel, linux kernel

A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but remove_on_exec made it possible to call list_del_event() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability. We recommend upgrading past commit fd0815f632c24878e325821943edccc7fde947a2.

CVSS: 7.8
EPSS: 0.25%
CISA KEV: Not listed
Published: 2023.05.01

PRIORITY ASSESSMENT

Review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.25%

Technical severityCVSS 7.8

Vulnerability overview

Affected product and versions

Product: Linux Linux Kernel, linux kernel
Affected versions: >= 5.13 < 6.3, >= 5.13 < 5.15.104, >= 5.16 < 6.1.21, >= 6.2 < 6.2.8
Fixed versions: 5.15.104, 6.1.21, 6.2.8

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux Linux Kernel, linux kernel and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-416