CVE-2023-2006 describes a race condition in the Linux kernel's RxRPC network protocol, specifically within the processing of RxRPC bundles, affecting various Linux kernel distributions and NetApp products. This vulnerability, rated High severity with a CVSS score of 7.0, stems from improper locking, allowing a local attacker with low privileges to potentially escalate privileges and execute arbitrary code within the kernel. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.10, < 5.10.157CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.11, < 5.15.81CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.16, < 6.0.11CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
h300sCPE matchmatch criteria | cpe:2.3:a:netapp:hci_baseboard_management_controller:h300s:*:*:*:*:*:*:* | ||
h410cCPE matchmatch criteria | cpe:2.3:a:netapp:hci_baseboard_management_controller:h410c:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.4 InfoSec Media, 0.1 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2023-2006
May 9, 2023kernel: rxrpc: race condition between connection bundle lookup and removal
Apr 13, 2023A race condition was found in the Linux kernel's RxRPC network protocol within the processing of RxRPC bundles. This issue results from the lack of proper locking when performing operations on an object. This may allow an attacker to escalate privileges and execute arbitrary code in the context of the kernel.
Apr 11, 2023