CVE-2023-2007

Aliases:UBUNTU-CVE-2023-2007DEBIAN-CVE-2023-2007
Advisory lineage Upstream: 0 Downstream: 23
Modified
Published: 24 Apr 2023, 00:00
Last modified:02 Aug 2024, 06:05

Vulnerability Summary

Overall Risk (default)
medium
31/100
CVSS Score
7.8 HIGH
v3.1 (nvd)
EPSS Score
0.29% LOW
0% probability +0.26%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

24 Apr 2023, 00:00
Published
Vulnerability first disclosed
02 Aug 2024, 06:05
Last Modified
Vulnerability information updated

Description

The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.

CVSS Metrics

  • v3.1•HIGH•Score: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.29%• Percentile: 22%

Techniques & Countermeasures

  • CWE-367•Time-of-check Time-of-use (TOCTOU) Race Condition

    The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

  • CWE-667•Improper Locking

    The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Affected Systems

  • debian•linux

    < 5.10.191-1 | < 6.0.2-1 | < 6.0.2-1 | < 6.0.2-1

  • ubuntu•linux

    all | all

  • ubuntu•linux-allwinner-5.19

    all

  • ubuntu•linux-aws

    all | all

  • ubuntu•linux-aws-5.0

    all

  • ubuntu•linux-aws-5.11

    all

  • ubuntu•linux-aws-5.13

    all

  • ubuntu•linux-aws-5.15

    all

  • ubuntu•linux-aws-5.19

    all

  • ubuntu•linux-aws-5.3

    all

  • ubuntu•linux-aws-5.4

    all

  • ubuntu•linux-aws-5.8

    all

  • ubuntu•linux-aws-fips

    all

  • ubuntu•linux-aws-hwe

    all

  • ubuntu•linux-azure

    all | all | all

  • ubuntu•linux-azure-4.15

    all

  • ubuntu•linux-azure-5.11

    all

  • ubuntu•linux-azure-5.13

    all

  • ubuntu•linux-azure-5.15

    all

  • ubuntu•linux-azure-5.19

    all

  • ubuntu•linux-azure-5.3

    all

  • ubuntu•linux-azure-5.4

    all

  • ubuntu•linux-azure-5.8

    all

  • ubuntu•linux-azure-edge

    all

  • ubuntu•linux-azure-fde

    all | all

  • ubuntu•linux-azure-fde-5.15

    all

  • ubuntu•linux-azure-fde-5.19

    all

  • ubuntu•linux-azure-fips

    all

  • ubuntu•linux-bluefield

    all | all

  • ubuntu•linux-fips

    all

  • ubuntu•linux-gcp

    all | all | all

  • ubuntu•linux-gcp-4.15

    all

  • ubuntu•linux-gcp-5.11

    all

  • ubuntu•linux-gcp-5.13

    all

  • ubuntu•linux-gcp-5.15

    all

  • ubuntu•linux-gcp-5.19

    all

  • ubuntu•linux-gcp-5.3

    all

  • ubuntu•linux-gcp-5.4

    all

  • ubuntu•linux-gcp-5.8

    all

  • ubuntu•linux-gcp-fips

    all

  • ubuntu•linux-gke

    all | all

  • ubuntu•linux-gke-4.15

    all

  • ubuntu•linux-gke-5.15

    all

  • ubuntu•linux-gke-5.4

    all

  • ubuntu•linux-gkeop

    all | all

  • ubuntu•linux-gkeop-5.15

    all

  • ubuntu•linux-gkeop-5.4

    all

  • ubuntu•linux-hwe

    all | all

  • ubuntu•linux-hwe-5.11

    all

  • ubuntu•linux-hwe-5.13

    all

Showing first 50 affected entries in server-rendered view.

References (8)