CVE-2023-3159: linux linux_kernel Use After Free
CVSS: 6.7v3.1MediumModified
AliasesUBUNTU-CVE-2023-3159DEBIAN-CVE-2023-3159
Published 12-06-2023Last modified 23-04-2025
Vulnerability summary
CVE-2023-3159 is a medium (CVSS 6.7) Use After Free vulnerability in linux linux_kernel. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11.2% of scored vulnerabilities.
CVSS score
6.7/10
010
Medium · v3.1 (CVE.org)EPSS score
0.21%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 20 · Related 20SUSE-SU-2023:2804-1SUSE-SU-2023:2805-1SUSE-SU-2023:2808-1SUSE-SU-2023:2810-1SUSE-SU-2023:2822-1SUSE-SU-2023:2830-1SUSE-SU-2023:2834-1SUSE-SU-2023:2859-1SUSE-SU-2023:3035-1SUSE-SU-2023:3046-1SUSE-SU-2023:3069-1SUSE-SU-2023:3073-1SUSE-SU-2023:3075-1SUSE-SU-2023:3081-1SUSE-SU-2023:3083-1SUSE-SU-2023:3104-1SUSE-SU-2023:3107-1SUSE-SU-2023:3333-1USN-6254-1USN-6341-1
Timeline
- 12-06-2023PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 6.7Preferred score · CVE.org (CNA)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- NVDNIST6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
0.00 pp
From 0.21% on 21-09-2026
21-09-202621-10-2026
EPSS score0.21%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu78 products
- linux< 3.13.0-193.244 | < 4.4.0-243.277 | < 4.15.0-191.202 | < 5.4.0-124.140 | < 5.15.0-41.44
- linux-aws< 4.4.0-1121.127 | < 4.4.0-1159.174 | < 4.15.0-1139.150 | < 5.4.0-1083.90 | < 5.15.0-1015.19
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
- linux-aws-5.13All versions (No fix recorded)
Debian1 product
- linux< 5.17.11-1
Linux1 product
- linux_kernelEOL< 5.18 | 5.18 | 5.18:rc1 | 5.18:rc2 | 5.18:rc3 | 5.18:rc4 | 5.18:rc5
3 vendors · 80 products
