Use-After-Free Vulnerability in Linux Kernel Package: linux (Debian 13 & 14)
Summary
DEBIAN-CVE-2023-4611: A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. Affects linux versions < 6.4.11-1. Fixed in 6.4.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux Kernel is the core component of the Linux operating system, responsible for managing system resources and hardware communication. It provides essential services for all other software running on the system. The linux package in Debian distributions is crucial for system stability and performance. This vulnerability affects versions of the linux package in Debian 13 and 14, potentially compromising system integrity.
Vulnerability Detail
A use-after-free flaw was identified in the memory management subsystem of the Linux Kernel, specifically in mm/mempolicy.c. This vulnerability arises from a race condition between the mbind() function and a VMA-locked page fault. If exploited by a local attacker, it could lead to system crashes or unauthorized access to kernel memory, resulting in information leaks.
How To Fix
Minimum fixed version
6.4.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As of now, no specific workarounds have been provided for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
The identified use-after-free vulnerability in the Linux Kernel's memory management subsystem poses significant risks to system integrity and security. It is crucial for users of Debian 13 and 14 to update their linux package to the patched version 6.4.11-1 to mitigate these risks.
See every vulnerability recorded for linux →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, potentially leading to memory corruption and security issues.
Exploitation of this vulnerability may allow local attackers to crash the system or leak sensitive kernel information, compromising system security.
If you are using Debian 13 or 14 with the linux package version prior to 6.4.11-1, your system is vulnerable.
You can check your current linux package version by running the command: dpkg -l | grep linux.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
