CVE-2023-2007 The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction w...
HighCVSS 7.8
EPSS 0.28%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 6.0.2-1 | 6.0.2-1 |
| debian/linux(Debian:13) | < 6.0.2-1 | 6.0.2-1 |
| debian/linux(Debian:14) | < 6.0.2-1 | 6.0.2-1 |
| ubuntu/linux(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/linux-kvm(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/linux-raspi(Ubuntu:22.04) | All versions | No fix listed |
| Linux kernel | < 6.0 | 6.0 |
| debian linux | = 10.0 | No fix listed |
| debian linux | = 11.0 | No fix listed |
| netapp h300s firmware | All versions | No fix listed |
| netapp h500s firmware | All versions | No fix listed |
| netapp h700s firmware | All versions | No fix listed |
| netapp h410s firmware | All versions | No fix listed |
| netapp h410c firmware | All versions | No fix listed |
| netapp solidfire hci management node | All versions | No fix listed |
References
- Debian Security Tracker CVE-2023-2007 vendor-advisory
- github.com patch
- [debian-lts-announce] 20230727 [SECURITY] [DLA 3508-1] linux security update mailing-list third-party-advisory
- DSA-5480 third-party-advisory vendor-advisory
- [debian-lts-announce] 20231019 [SECURITY] [DLA 3623-1] linux-5.10 security update mailing-list third-party-advisory
- security.netapp.com third-party-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org