CVE-2023-53747

A flaw was found in the Linux kernel. A local user can exploit a use-after-free (UAF) vulnerability in the vc_screen component. This occurs because a pointer to the vc_data structure is not reloaded after a console unlock operation, leading to the use of freed memory. Successful exploitation of this flaw can result in a denial of service, making the system unavailable.

A moderate use-after-free flaw was found in the Linux kernel's virtual console screen driver (vc_screen), affecting the kernel and kernel-rt components in Red Hat Enterprise Linux 7, 8, and 9 update streams. In vcs_write(), the pointer to the vc_data structure is not reloaded after console_unlock(); during that window the structure can be freed by vc_port_destruct() (for example, via a concurrent virtual terminal deallocation that calls vt_disallocate_all()), so a subsequent call to vcs_size() in the same write loop may access freed memory. A local user able to write to the virtual console screen device while virtual terminals are being deallocated can exploit this race to cause a kernel fault and crash, resulting in a denial of service. The demonstrated impact is limited to availability; Red Hat therefore rates this flaw Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs from the upstream CVE record severity of Important (7.8) that also assumes confidentiality and integrity impact. Because the flaw is a moderate-severity, local denial-of-service issue, the fix for the affected Red Hat Enterprise Linux 7, 8, and 9 update streams has been deferred rather than shipped as an immediate update; the residual risk is that an authenticated local user could crash the system. Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.