CVE-2023-25012: linux linux_kernel Use After Free
CVSS: 4.6v3.1MediumModified
AliasesUBUNTU-CVE-2023-25012DEBIAN-CVE-2023-25012
Published 01-02-2023Last modified 05-05-2025
Vulnerability summary
CVE-2023-25012 is a medium (CVSS 4.6) Use After Free vulnerability in linux linux_kernel. EPSS estimates a 0.79% chance of exploitation in the next 30 days, higher than 55.6% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
4.6/10
010
Medium · v3.1 (CVE.org)EPSS score
0.79%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference
Advisory lineage
Upstream 0 · Downstream 22 · Related 19DLA-3404-1MGASA-2023-0148MGASA-2023-0149SUSE-SU-2023:0749-1SUSE-SU-2023:0749-2SUSE-SU-2023:0779-1SUSE-SU-2023:1608-1SUSE-SU-2023:1609-1SUSE-SU-2023:1710-1SUSE-SU-2023:1800-1SUSE-SU-2023:1811-1SUSE-SU-2023:2646-1SUSE-SU-2023:2809-1SUSE-SU-2023:2871-1USN-6033-1USN-6171-1USN-6172-1USN-6185-1USN-6207-1USN-6222-1USN-6223-1USN-6256-1
Timeline
- 01-02-2023PublishedVulnerability first disclosed.
- 05-05-2025Last modifiedVulnerability information updated.
Description
The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 4.6Preferred score · CVE.org (CNA)
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated4.6MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated4.6MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST4.6MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.79%
Chance of exploitation in the next 30 days
Percentile
56%
Versus all other CVEs
30-day change
0.00 pp
From 0.79% on 21-09-2026
21-09-202621-10-2026
EPSS score0.79%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (seclists.org)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Ubuntu87 products
- linux< 5.4.0-152.169 | < 5.15.0-75.82
- linux-aws< 5.4.0-1104.112 | < 5.15.0-1038.43
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
- linux-aws-5.13All versions (No fix recorded)
Debian1 product
- linux< 6.1.20-1
Linux1 product
- linux_kernel≤ 6.1.9
3 vendors · 89 products
References
23 links
- www.openwall.com/lists/oss-security/2023/11/05/1Mailing List
