CVE-2023-52975

A flaw was found in the Linux kernel's Internet Small Computer System Interface (iSCSI) TCP subsystem. A local user can cause a Denial of Service (DoS) or potentially achieve privilege escalation by triggering a use-after-free vulnerability. This issue occurs due to a race condition when an iSCSI session is disconnected while another process queries the host IP address attribute through the sysfs virtual file system, causing the kernel to access memory that has already been deallocated.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires local access and precise timing during an active session teardown, limiting the realistic attack surface. The issue only affects environments utilizing software iSCSI over TCP where an attacker can locally read sysfs host parameters while a session is disconnecting. Systems that do not configure software iSCSI or where session teardowns are restricted to trusted administrative workflows are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.