CVE-2023-3567: Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race

Modified

AliasesUBUNTU-CVE-2023-3567DEBIAN-CVE-2023-3567

Published 24-07-2023Last modified 06-11-2025

Vulnerability summary

CVE-2023-3567 is a high (CVSS 7.1) Use After Free vulnerability in canonical ubuntu_linux. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 36.2% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.1, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.1/10

010

High · v3.1 (CVE.org)

EPSS score

0.42%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 63 · Related 52

LSN-0098-1 LSN-0099-1 RHSA-2024:0412 RHSA-2024:0431 RHSA-2024:0432 RHSA-2024:0439+57 more

Timeline

24-07-2023
PublishedVulnerability first disclosed.
06-11-2025
Last modifiedVulnerability information updated.

Description

A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.

CVSS metrics

4 scores · 4 sources · 1 version

v3.17.1

EPSS trend

Probability

0.42%

Chance of exploitation in the next 30 days

Percentile

36%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.42% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu95 products

linux< 3.13.0-193.244 | < 4.4.0-244.278 | < 4.15.0-211.222 | < 5.4.0-149.166 | < 5.15.0-72.79
linux-allwinner-5.19< 5.19.0-1012.12~22.04.1
linux-aws< 4.4.0-1122.128 | < 4.4.0-1160.175 | < 4.15.0-1156.169 | < 5.4.0-1102.110 | < 5.15.0-1036.40
linux-aws-5.0All versions (No fix recorded)
linux-aws-5.11All versions (No fix recorded)

linux-aws-5.13All versions (No fix recorded)
linux-aws-5.15< 5.15.0-1036.40~20.04.1
linux-aws-5.19All versions (No fix recorded)
linux-aws-5.3All versions (No fix recorded)
linux-aws-5.4< 5.4.0-1103.111~18.04.1
linux-aws-5.8All versions (No fix recorded)
linux-aws-fips< 4.15.0-2095.101 | All versions (No fix recorded) | < 5.4.0-1102.110+fips1
linux-aws-hwe< 4.15.0-1156.169~16.04.1
linux-azure< 4.15.0-1165.180~14.04.1 | < 4.15.0-1165.180~16.04.1 | All versions (No fix recorded) | < 5.4.0-1108.114 | < 5.15.0-1038.45
linux-azure-4.15< 4.15.0-1165.180
linux-azure-5.11All versions (No fix recorded)
linux-azure-5.13All versions (No fix recorded)
linux-azure-5.15< 5.15.0-1038.45~20.04.1
linux-azure-5.19All versions (No fix recorded)
linux-azure-5.3All versions (No fix recorded)
linux-azure-5.4< 5.4.0-1108.114~18.04.1
linux-azure-5.8All versions (No fix recorded)
linux-azure-edgeAll versions (No fix recorded)
linux-azure-fde< 5.15.0-1038.45.1
linux-azure-fde-5.19All versions (No fix recorded)
linux-azure-fips< 4.15.0-2074.80 | All versions (No fix recorded) | < 5.4.0-1108.114+fips1
linux-bluefield< 5.4.0-1064.70 | < 5.15.0-1017.19
linux-fips< 4.4.0-1092.99 | All versions (No fix recorded) | < 4.15.0-1111.122 | < 5.4.0-1077.86
linux-gcp< 4.15.0-1150.166~16.04.1 | All versions (No fix recorded) | < 5.4.0-1105.114 | < 5.15.0-1034.42
linux-gcp-4.15< 4.15.0-1150.166
linux-gcp-5.11All versions (No fix recorded)
linux-gcp-5.13All versions (No fix recorded)
linux-gcp-5.15< 5.15.0-1034.42~20.04.1
linux-gcp-5.19All versions (No fix recorded)
linux-gcp-5.3All versions (No fix recorded)
linux-gcp-5.4< 5.4.0-1105.114~18.04.1
linux-gcp-5.8All versions (No fix recorded)
linux-gcp-fips< 4.15.0-2058.63 | All versions (No fix recorded) | < 5.4.0-1105.114+fips1
linux-gke< 5.4.0-1099.106 | < 5.15.0-1033.38
linux-gke-4.15All versions (No fix recorded)
linux-gke-5.15All versions (No fix recorded)
linux-gke-5.4All versions (No fix recorded)
linux-gkeop< 5.4.0-1069.73 | < 5.15.0-1020.25
linux-gkeop-5.15< 5.15.0-1020.25~20.04.1
linux-gkeop-5.4All versions (No fix recorded)
linux-hwe< 4.15.0-211.222~16.04.1 | All versions (No fix recorded)
linux-hwe-5.11All versions (No fix recorded)
linux-hwe-5.13All versions (No fix recorded)
linux-hwe-5.15< 5.15.0-72.79~20.04.1
linux-hwe-5.19< 5.19.0-42.43~22.04.1
linux-hwe-5.4< 5.4.0-149.166~18.04.1
linux-hwe-5.8All versions (No fix recorded)
linux-hwe-edgeAll versions (No fix recorded)
linux-ibm< 5.4.0-1049.54 | < 5.15.0-1030.33
linux-ibm-5.4< 5.4.0-1049.54~18.04.1
linux-intel-5.13All versions (No fix recorded)
linux-intel-iot-realtime< 5.15.0-1028.33
linux-intel-iotg< 5.15.0-1030.35
linux-intel-iotg-5.15< 5.15.0-1030.35~20.04.1
linux-iot< 5.4.0-1017.18
linux-kvm< 4.4.0-1123.133 | < 4.15.0-1140.145 | < 5.4.0-1091.97 | < 5.15.0-1033.38
linux-lowlatency< 5.15.0-72.79
linux-lowlatency-hwe-5.15< 5.15.0-72.79~20.04.1
linux-lowlatency-hwe-5.19< 5.19.0-1024.25~22.04.1
linux-lts-xenial< 4.4.0-244.278~14.04.1
linux-nvidia< 5.15.0-1025.25
linux-nvidia-tegra-5.15< 5.15.0-1014.14~20.04.1
linux-oemAll versions (No fix recorded)
linux-oem-5.10All versions (No fix recorded)
linux-oem-5.13All versions (No fix recorded)
linux-oem-5.14All versions (No fix recorded)
linux-oem-5.17All versions (No fix recorded)
linux-oem-5.6All versions (No fix recorded)
linux-oem-6.0All versions (No fix recorded)
linux-oem-6.1< 6.1.0-1008.8
linux-oracle< 4.15.0-1119.130~16.04.1 | < 4.15.0-1119.130 | < 5.4.0-1101.110 | < 5.15.0-1035.41
linux-oracle-5.0All versions (No fix recorded)
linux-oracle-5.11All versions (No fix recorded)
linux-oracle-5.13All versions (No fix recorded)
linux-oracle-5.15< 5.15.0-1035.41~20.04.1
linux-oracle-5.3All versions (No fix recorded)
linux-oracle-5.4< 5.4.0-1101.110~18.04.1
linux-oracle-5.8All versions (No fix recorded)
linux-raspi< 5.4.0-1085.96 | < 5.15.0-1029.31
linux-raspi-5.4< 5.4.0-1085.96~18.04.1
linux-raspi-realtimeAll versions (No fix recorded)
linux-raspi2All versions (No fix recorded)
linux-realtimeAll versions (No fix recorded) | < 5.15.0-1038.41
linux-riscvAll versions (No fix recorded)
linux-riscv-5.11All versions (No fix recorded)
linux-riscv-5.15< 5.15.0-1033.37~20.04.1
linux-riscv-5.19All versions (No fix recorded)
linux-riscv-5.8All versions (No fix recorded)
linux-starfive-5.19All versions (No fix recorded)
linux-xilinx-zynqmp< 5.4.0-1024.28

Show all 95

Canonical1 product

ubuntu_linuxEOL14.04 | 16.04 | 18.04 | 20.04 | 22.04

Debian1 product

linux< 6.1.11-1

Linux1 product

linux_kernelEOL< 6.2.0 | 6.2.0:rc1 | 6.2.0:rc2 | 6.2.0:rc3 | 6.2.0:rc4 | 6.2.0:rc5 | 6.2.0:rc6

Redhat1 product

enterprise_linux8.0 | 9.0

5 vendors · 99 products

References

22 links

access.redhat.com/errata/RHSA-2024:0412Vendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2024:0431Vendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2024:0432Vendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2024:0439Vendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2024:0448Vendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2024:0575Vendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2024:2394Vendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2024:2950Vendor AdvisoryX Refsource REDHAT
access.redhat.com/errata/RHSA-2024:3138Vendor AdvisoryX Refsource REDHAT
access.redhat.com/security/cve/CVE-2023-3567VDB EntryX Refsource REDHATThird Party Advisory

Show all 22 references

bugzilla.redhat.com/show_bug.cgi?id=2221463Issue TrackingX Refsource REDHATThird Party Advisory
www.spinics.net/lists/stable-commits/msg285184.htmlREPORTMailing ListPatch
packetstormsecurity.com/files/175072/Kernel-Live-Patch-Security-Notice-LSN-0098-1.htmlX Transferred
packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.htmlX Transferred
ubuntu.com/security/CVE-2023-3567REPORT
git.kernel.org/linus/226fae124b2dac217ea5436060d623ff3385bc34REPORT
ubuntu.com/security/notices/USN-6309-1Advisory
ubuntu.com/security/notices/USN-6327-1Advisory
ubuntu.com/security/notices/USN-6341-1Advisory
www.cve.org/CVERecord?id=CVE-2023-3567REPORT
security-tracker.debian.org/tracker/CVE-2023-3567Advisory
nvd.nist.gov/vuln/detail/CVE-2023-3567OvalAdvisory