CVE-2023-3439
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A flaw was found in the MCTP protocol in the Linux kernel that may lead to use-after-free vulnerabilities. The mctp_unregister() function reclaims the device's resources when a netcard detaches, which can cause issues if a running routine is unaware of this.
Risk Assessment
This vulnerability may lead to denial of service, affecting system availability. Potential exploitation could disrupt applications relying on the MCTP protocol.
Recommendation
It is recommended to update the Linux kernel to the latest version to mitigate this vulnerability. Monitoring the system for unauthorized activities is also advisable.
Original NVD description (English source)
A flaw was found in the MCTP protocol in the Linux kernel. The function mctp_unregister() reclaims the device's relevant resource when a netcard detaches. However, a running routine may be unaware of this and cause the use-after-free of the mdev->addrs object, potentially leading to a denial of service.