CVE-2023-4134: Vulnerability in linux-libc-dev - Use-after-free in cyttsp4_core driver
Summary
CVE-2023-4134: A use-after-free vulnerability was found in the cyttsp4_core driver in the Linux kernel. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
linux-libc-dev is a package in the Debian operating system that provides the C library development files for the Linux kernel. It is an essential component for building and compiling applications on Debian-based systems. The cyttsp4_core driver is a part of the Linux kernel that handles communication with certain touchscreens. This driver is vulnerable to a use-after-free issue, which can lead to a denial of service (DoS) attack.
Vulnerability Detail
The use-after-free vulnerability in the cyttsp4_core driver occurs during the device cleanup routine. It is caused by a possible rearming of the watchdog_timer from the workqueue. This vulnerability can be exploited by a local user to crash the system, resulting in a DoS condition. The impact of this vulnerability is limited to local users with access to the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability at the moment. It is recommended to apply the official patches or updates provided by the Debian Security Tracker.
Conclusion
The use-after-free vulnerability in the cyttsp4_core driver of the linux-libc-dev package can be exploited by local users to crash the system, causing a denial of service. It is important to keep the system up to date with the latest patches and security fixes to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for linux →
FAQ
linux-libc-dev is a package in the Debian operating system that provides the C library development files for the Linux kernel. It is essential for building and compiling applications on Debian-based systems.
The cyttsp4_core driver is a part of the Linux kernel that handles communication with certain touchscreens.
A use-after-free vulnerability occurs when a program or driver continues to use a memory location after it has been freed. This can lead to crashes, memory corruption, and potentially, remote code execution.
This vulnerability primarily affects local users with access to the affected system. Remote exploitation is not possible without additional vulnerabilities.
To protect your system, it is recommended to update the linux-libc-dev package to a version that includes the necessary patches. Regularly updating the system and applying security fixes is crucial.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
