Bug 2208311 (CVE-2023-2007, ZDI-23-440, ZDI-CAN-17016)

Summary: CVE-2023-2007 kernel: DPT I2O controller TOCTOU information disclosure vulnerability
Product: [Other] Security Response Reporter: Mauro Matteo Cascella <mcascell>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, allarkin, bhu, chwhite, crwood, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, ldoskova, lgoncalv, lleshchi, lzampier, nmurray, ptalbert, qzhao, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel 6.0-rc1 Doc Type: ---
Doc Text:
A time-of-check time-of-use (TOCTOU) information disclosure vulnerability was found in the Linux Kernel DPT I2O controller. This issue results from the lack of proper locking when performing operations on an object, allowing a privileged local user to escalate privileges and execute arbitrary code in the context of the kernel.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2023-05-18 20:31:48 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 2186277    

Description Mauro Matteo Cascella 2023-05-18 14:46:24 UTC 
A time-of-check time-of-use (TOCTOU) information disclosure vulnerability was found in the Linux Kernel DPT I2O controller. Quoting ZDI security advisory [1]:

"This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel."

[1] https://www.zerodayinitiative.com/advisories/ZDI-23-440/
Comment 1 Product Security DevOps Team 2023-05-18 20:31:44 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-2007
Comment 2 Mauro Matteo Cascella 2023-07-06 14:32:09 UTC 
Upstream fix:
https://github.com/torvalds/linux/commit/b04e75a4a8a81887386a0d2dbf605a48e779d2a0