Bug 2208311 (CVE-2023-2007, ZDI-23-440, ZDI-CAN-17016) - CVE-2023-2007 kernel: DPT I2O controller TOCTOU information disclosure vulnerability
Summary: CVE-2023-2007 kernel: DPT I2O controller TOCTOU information disclosure vulner...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2023-2007, ZDI-23-440, ZDI-CAN-17016
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2186277
TreeView+ depends on / blocked
 
Reported: 2023-05-18 14:46 UTC by Mauro Matteo Cascella
Modified: 2023-07-06 14:32 UTC (History)
44 users (show)

Fixed In Version: kernel 6.0-rc1
Doc Type: ---
Doc Text:
A time-of-check time-of-use (TOCTOU) information disclosure vulnerability was found in the Linux Kernel DPT I2O controller. This issue results from the lack of proper locking when performing operations on an object, allowing a privileged local user to escalate privileges and execute arbitrary code in the context of the kernel.
Clone Of:
Environment:
Last Closed: 2023-05-18 20:31:48 UTC
Embargoed:


Attachments (Terms of Use)

Description Mauro Matteo Cascella 2023-05-18 14:46:24 UTC
A time-of-check time-of-use (TOCTOU) information disclosure vulnerability was found in the Linux Kernel DPT I2O controller. Quoting ZDI security advisory [1]:

"This vulnerability allows local attackers to disclose sensitive information on affected installations of Linux Kernel. An attacker must first obtain the ability to execute high-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel."

[1] https://www.zerodayinitiative.com/advisories/ZDI-23-440/

Comment 1 Product Security DevOps Team 2023-05-18 20:31:44 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-2007

Comment 2 Mauro Matteo Cascella 2023-07-06 14:32:09 UTC
Upstream fix:
https://github.com/torvalds/linux/commit/b04e75a4a8a81887386a0d2dbf605a48e779d2a0


Note You need to log in before you can comment on or make changes to this bug.