CVE-2023-52483

Summary

CVE-2023-52483 is a vulnerability affecting the Linux kernel's mctp (Multicast Transport Protocol) component. The issue lies in the lack of proper read-side critical section locks during route lookups, making them susceptible to preemption. This can result in potential grace period expiry and a subsequent kfree() operation while the route pointer is still in use. The vulnerability, as identified by Sili Luo of Huawei, could potentially lead to a Use-After-Free (UAF) condition when simultaneous sendmsg() and route deletion occur. To mitigate this risk, the necessary read-side critical section locks have been added around the affected route lookups.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.