Log in Start free

Vulnerability · Published Apr 24, 2023 · Assigned by redhat

CVE-2023-2007

High 7.8

In plain English

A high-severity security flaw in Linux kernel's DPT I2O Controller driver. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.3%top 79.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.0.2-1DEBIAN-CVE-2023-2007
Debian:13linux6.0.2-1DEBIAN-CVE-2023-2007
Debian:14linux6.0.2-1DEBIAN-CVE-2023-2007
Ubuntu:22.04:LTSlinuxno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-awsno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-azureno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-intel-iotgno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-kvmno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-nvidia-tegrano fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-nvidia-tegra-igxno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-raspino fix listedUBUNTU-CVE-2023-2007
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2023-2007
Ubuntu:22.04:LTSlinux-xilinx-zynqmpno fix listedUBUNTU-CVE-2023-2007

Affected products (as reported)

VendorProductVersions
n/a Linux kernel's DPT I2O Controller driver Fixed in kernel v6.0-rc1

Weakness: CWE-367

References