GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OESA-2023-1779 (CVE-2022-44033)

Vulnerability from osv_openeuler – Published: 2023-11-03 11:06 – Updated: 2026-08-06 11:06 – Source website
VLAI
Summary
kernel security update
Details

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach().(CVE-2022-44033)

An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.(CVE-2022-45919)

An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu->proto is set. A NULL pointer dereference may occur.(CVE-2023-31083)

An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.(CVE-2023-31085)

Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable. A (malicious) guest administrator could cause a denial of service (DoS) in a backend domain (other than dom0) by disabling a paravirtualized device. A malicious backend could cause DoS in a guest running a Linux kernel by disabling a paravirtualized device.(CVE-2023-34324)

A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure.(CVE-2023-39194)

An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.(CVE-2023-45863)

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation.

If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer.

We recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.

(CVE-2023-5717)

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "python2-perf-debuginfo-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "perf-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "bpftool-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "kernel-tools-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "kernel-source-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "python2-perf-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "kernel-debuginfo-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "kernel-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "kernel-debugsource-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "bpftool-debuginfo-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "python3-perf-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "kernel-tools-debuginfo-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "perf-debuginfo-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "python3-perf-debuginfo-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "kernel-devel-4.19.90-2311.1.0.0224.oe1.aarch64.rpm",
          "kernel-tools-devel-4.19.90-2311.1.0.0224.oe1.aarch64.rpm"
        ],
        "src": [
          "kernel-4.19.90-2311.1.0.0224.oe1.src.rpm"
        ],
        "x86_64": [
          "python3-perf-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "kernel-tools-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "bpftool-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "perf-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "python3-perf-debuginfo-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "kernel-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "python2-perf-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "perf-debuginfo-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "kernel-tools-devel-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "kernel-source-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "kernel-debuginfo-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "kernel-debugsource-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "bpftool-debuginfo-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "python2-perf-debuginfo-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "kernel-devel-4.19.90-2311.1.0.0224.oe1.x86_64.rpm",
          "kernel-tools-debuginfo-4.19.90-2311.1.0.0224.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP1",
        "name": "kernel",
        "purl": "pkg:rpm/openEuler/kernel\u0026distro=openEuler-20.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.19.90-2311.1.0.0224.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach().(CVE-2022-44033)\r\n\r\nAn issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect after an open, because of the lack of a wait_event.(CVE-2022-45919)\r\n\r\nAn issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a race condition between HCIUARTSETPROTO and HCIUARTGETPROTO. HCI_UART_PROTO_SET is set before hu-\u0026gt;proto is set. A NULL pointer dereference may occur.(CVE-2023-31083)\r\n\r\nAn issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd-\u0026gt;erasesize), used indirectly by ctrl_cdev_ioctl, when mtd-\u0026gt;erasesize is 0.(CVE-2023-31085)\r\n\r\nClosing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest. The closing of an event channel is e.g. triggered by removal of a paravirtual device on the other side. As this action will cause console messages to be issued on the other side quite often, the chance of triggering the deadlock is not neglectable.\nA (malicious) guest administrator could cause a denial of service (DoS) in a backend domain (other than dom0) by disabling a paravirtualized device. A malicious backend could cause DoS in a guest running a Linux kernel by disabling a paravirtualized device.(CVE-2023-34324)\r\n\r\nA flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, potentially leading to an information disclosure.(CVE-2023-39194)\r\n\r\nAn issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.(CVE-2023-45863)\r\n\r\nA heap out-of-bounds write vulnerability in the Linux kernel\u0026apos;s Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation.\r\n\r\nIf perf_read_group() is called while an event\u0026apos;s sibling_list is smaller than its child\u0026apos;s sibling_list, it can increment or write to memory locations outside of the allocated buffer.\r\n\r\nWe recommend upgrading past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06.\r\n\r\n(CVE-2023-5717)",
  "id": "OESA-2023-1779",
  "modified": "2026-08-06T11:06:13Z",
  "published": "2023-11-03T11:06:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1779"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-44033"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45919"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31083"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31085"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34324"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39194"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45863"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5717"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kernel security update",
  "upstream": [
    "CVE-2022-44033",
    "CVE-2022-45919",
    "CVE-2023-31083",
    "CVE-2023-31085",
    "CVE-2023-34324",
    "CVE-2023-39194",
    "CVE-2023-45863",
    "CVE-2023-5717"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.