CVE-2023-52872 (GCVE-0-2023-52872)

Vulnerability from cvelistv5 – Published: 2024-05-21 15:32 – Updated: 2026-08-05 09:11
VLAI
Title
tty: n_gsm: fix race condition in status line change on dead connections
Summary
In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix race condition in status line change on dead connections gsm_cleanup_mux() cleans up the gsm by closing all DLCIs, stopping all timers, removing the virtual tty devices and clearing the data queues. This procedure, however, may cause subsequent changes of the virtual modem status lines of a DLCI. More data is being added the outgoing data queue and the deleted kick timer is restarted to handle this. At this point many resources have already been removed by the cleanup procedure. Thus, a kernel panic occurs. Fix this by proving in gsm_modem_update() that the cleanup procedure has not been started and the mux is still alive. Note that writing to a virtual tty is already protected by checks against the DLCI specific connection state.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-29 18:43 UTC
CWE
  • CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: dd37f657387853623f20c1b2482afbb9cd8ece33 , < 81a4dd5e6c78f5d8952fa8c9d36565db1fe01444 (git)
Affected: c568f7086c6e771c77aad13d727c70ef70e07243 , < df6cfab66ff2a44bd23ad5dd5309cb3421bb6593 (git)
Affected: c568f7086c6e771c77aad13d727c70ef70e07243 , < 19d34b73234af542cc8a218cf398dee73cdb1890 (git)
Affected: c568f7086c6e771c77aad13d727c70ef70e07243 , < ce4df90333c4fe65acb8b5089fdfe9b955ce976a (git)
Affected: c568f7086c6e771c77aad13d727c70ef70e07243 , < 3a75b205de43365f80a33b98ec9289785da56243 (git)
Affected: d834aba5f30d9a6f98f4ca1eb07e501f1989331c (git)
Affected: 692e847a8e6607909c4a3f98ab16ccee7849bd11 (git)
Affected: 5.15.61 , < 5.15.138 (semver)
Affected: 5.18.18 , < 5.19 (semver)
Affected: 5.19.2 , < 5.20 (semver)
Create a notification for this product.
Linux Linux Affected: 6.0
Unaffected: 0 , < 6.0 (semver)
Unaffected: 5.15.138 , ≤ 5.15.* (semver)
Unaffected: 6.1.62 , ≤ 6.1.* (semver)
Unaffected: 6.5.11 , ≤ 6.5.* (semver)
Unaffected: 6.6.1 , ≤ 6.6.* (semver)
Unaffected: 6.7 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-52872",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-29T18:43:05.660039Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-06T15:02:28.263Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:36.237Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/81a4dd5e6c78f5d8952fa8c9d36565db1fe01444"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/df6cfab66ff2a44bd23ad5dd5309cb3421bb6593"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/19d34b73234af542cc8a218cf398dee73cdb1890"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ce4df90333c4fe65acb8b5089fdfe9b955ce976a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3a75b205de43365f80a33b98ec9289785da56243"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/n_gsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "81a4dd5e6c78f5d8952fa8c9d36565db1fe01444",
              "status": "affected",
              "version": "dd37f657387853623f20c1b2482afbb9cd8ece33",
              "versionType": "git"
            },
            {
              "lessThan": "df6cfab66ff2a44bd23ad5dd5309cb3421bb6593",
              "status": "affected",
              "version": "c568f7086c6e771c77aad13d727c70ef70e07243",
              "versionType": "git"
            },
            {
              "lessThan": "19d34b73234af542cc8a218cf398dee73cdb1890",
              "status": "affected",
              "version": "c568f7086c6e771c77aad13d727c70ef70e07243",
              "versionType": "git"
            },
            {
              "lessThan": "ce4df90333c4fe65acb8b5089fdfe9b955ce976a",
              "status": "affected",
              "version": "c568f7086c6e771c77aad13d727c70ef70e07243",
              "versionType": "git"
            },
            {
              "lessThan": "3a75b205de43365f80a33b98ec9289785da56243",
              "status": "affected",
              "version": "c568f7086c6e771c77aad13d727c70ef70e07243",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d834aba5f30d9a6f98f4ca1eb07e501f1989331c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "692e847a8e6607909c4a3f98ab16ccee7849bd11",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.138",
              "status": "affected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThan": "5.20",
              "status": "affected",
              "version": "5.19.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/n_gsm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.138",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.62",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.7",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.138",
                  "versionStartIncluding": "5.15.61",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.62",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.11",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.1",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.19.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: fix race condition in status line change on dead connections\n\ngsm_cleanup_mux() cleans up the gsm by closing all DLCIs, stopping all\ntimers, removing the virtual tty devices and clearing the data queues.\nThis procedure, however, may cause subsequent changes of the virtual modem\nstatus lines of a DLCI. More data is being added the outgoing data queue\nand the deleted kick timer is restarted to handle this. At this point many\nresources have already been removed by the cleanup procedure. Thus, a\nkernel panic occurs.\n\nFix this by proving in gsm_modem_update() that the cleanup procedure has\nnot been started and the mux is still alive.\n\nNote that writing to a virtual tty is already protected by checks against\nthe DLCI specific connection state."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through local tty/pty operations: attach N_GSM0710 via TIOCSETD, configure with GSMIOC_SETCONF, and tear down the mux via close or reconfiguration\u2014not via network packets.\nAC:L - The attacker fully controls setup (including adaption=2 or basic encoding so gsm_modem_update queues data) and teardown; cleanup itself synchronously triggers the modem-status update that restarts the already-deleted kick_timer, so no external timing luck is required.\nPR:L - Across the affected range (from the kick_timer introduction through the fix), attaching N_GSM0710 did not require CAP_NET_ADMIN until 67c37756898a; an unprivileged local user with a pty could open the ldisc, configure the mux, and trigger cleanup.\nUI:N - Exploitation needs no victim action beyond the attacker\u2019s own syscalls on tty/pty and gsmtty devices.\nS:U - Impact stays within the host kernel authority; this is not a VM escape, IOMMU bypass, or other cross-boundary break.\nC:H - Cleanup restarts kick_timer and can free gsm_mux (gsm_free_mux does not cancel that timer), yielding a timer use-after-free on gsm_mux that can be reclaimed and read for arbitrary kernel disclosure.\nI:H - The same timer UAF on the freed gsm_mux object enables heap reuse and corruption of kernel control data (locks, DLCI pointers, TX state) for integrity compromise and potential code execution.\nA:H - The dangling kick_timer and use of torn-down queues/DLCIs cause kernel oops/panic, as described in the fix, so availability impact is complete host denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:11:46.257Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/81a4dd5e6c78f5d8952fa8c9d36565db1fe01444"
        },
        {
          "url": "https://git.kernel.org/stable/c/df6cfab66ff2a44bd23ad5dd5309cb3421bb6593"
        },
        {
          "url": "https://git.kernel.org/stable/c/19d34b73234af542cc8a218cf398dee73cdb1890"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce4df90333c4fe65acb8b5089fdfe9b955ce976a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a75b205de43365f80a33b98ec9289785da56243"
        }
      ],
      "title": "tty: n_gsm: fix race condition in status line change on dead connections",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52872",
    "datePublished": "2024-05-21T15:32:06.610Z",
    "dateReserved": "2024-05-21T15:19:24.264Z",
    "dateUpdated": "2026-08-05T09:11:46.257Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52872",
      "date": "2026-08-12",
      "epss": "0.00179",
      "percentile": "0.07628"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntty: n_gsm: fix race condition in status line change on dead connections\\n\\ngsm_cleanup_mux() cleans up the gsm by closing all DLCIs, stopping all\\ntimers, removing the virtual tty devices and clearing the data queues.\\nThis procedure, however, may cause subsequent changes of the virtual modem\\nstatus lines of a DLCI. More data is being added the outgoing data queue\\nand the deleted kick timer is restarted to handle this. At this point many\\nresources have already been removed by the cleanup procedure. Thus, a\\nkernel panic occurs.\\n\\nFix this by proving in gsm_modem_update() that the cleanup procedure has\\nnot been started and the mux is still alive.\\n\\nNote that writing to a virtual tty is already protected by checks against\\nthe DLCI specific connection state.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tty: n_gsm: corrige la condici\\u00f3n de ejecuci\\u00f3n en la l\\u00ednea de estado, cambia en conexiones inactivas gsm_cleanup_mux() limpia el gsm cerrando todos los DLCI, deteniendo todos los temporizadores, eliminando los dispositivos tty virtuales y limpiando el colas de datos. Sin embargo, este procedimiento puede provocar cambios posteriores en las l\\u00edneas de estado del m\\u00f3dem virtual de un DLCI. Se agregan m\\u00e1s datos a la cola de datos salientes y el temporizador de eliminaci\\u00f3n eliminado se reinicia para manejar esto. En este punto, el procedimiento de limpieza ya ha eliminado muchos recursos. Por tanto, se produce un p\\u00e1nico en el n\\u00facleo. Solucione este problema demostrando en gsm_modem_update() que el procedimiento de limpieza no se ha iniciado y que el mux sigue activo. Tenga en cuenta que la escritura en un tty virtual ya est\\u00e1 protegida mediante comprobaciones del estado de conexi\\u00f3n espec\\u00edfico de DLCI.\"}]",
      "id": "CVE-2023-52872",
      "lastModified": "2024-11-21T08:40:46.170",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-05-21T16:15:23.990",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/19d34b73234af542cc8a218cf398dee73cdb1890\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/3a75b205de43365f80a33b98ec9289785da56243\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/81a4dd5e6c78f5d8952fa8c9d36565db1fe01444\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ce4df90333c4fe65acb8b5089fdfe9b955ce976a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/df6cfab66ff2a44bd23ad5dd5309cb3421bb6593\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/19d34b73234af542cc8a218cf398dee73cdb1890\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/3a75b205de43365f80a33b98ec9289785da56243\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/81a4dd5e6c78f5d8952fa8c9d36565db1fe01444\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ce4df90333c4fe65acb8b5089fdfe9b955ce976a\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/df6cfab66ff2a44bd23ad5dd5309cb3421bb6593\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-362\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52872\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T16:15:23.990\",\"lastModified\":\"2026-08-04T10:18:46.877\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntty: n_gsm: fix race condition in status line change on dead connections\\n\\ngsm_cleanup_mux() cleans up the gsm by closing all DLCIs, stopping all\\ntimers, removing the virtual tty devices and clearing the data queues.\\nThis procedure, however, may cause subsequent changes of the virtual modem\\nstatus lines of a DLCI. More data is being added the outgoing data queue\\nand the deleted kick timer is restarted to handle this. At this point many\\nresources have already been removed by the cleanup procedure. Thus, a\\nkernel panic occurs.\\n\\nFix this by proving in gsm_modem_update() that the cleanup procedure has\\nnot been started and the mux is still alive.\\n\\nNote that writing to a virtual tty is already protected by checks against\\nthe DLCI specific connection state.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tty: n_gsm: corrige la condici\u00f3n de ejecuci\u00f3n en la l\u00ednea de estado, cambia en conexiones inactivas gsm_cleanup_mux() limpia el gsm cerrando todos los DLCI, deteniendo todos los temporizadores, eliminando los dispositivos tty virtuales y limpiando el colas de datos. Sin embargo, este procedimiento puede provocar cambios posteriores en las l\u00edneas de estado del m\u00f3dem virtual de un DLCI. Se agregan m\u00e1s datos a la cola de datos salientes y el temporizador de eliminaci\u00f3n eliminado se reinicia para manejar esto. En este punto, el procedimiento de limpieza ya ha eliminado muchos recursos. Por tanto, se produce un p\u00e1nico en el n\u00facleo. Solucione este problema demostrando en gsm_modem_update() que el procedimiento de limpieza no se ha iniciado y que el mux sigue activo. Tenga en cuenta que la escritura en un tty virtual ya est\u00e1 protegida mediante comprobaciones del estado de conexi\u00f3n espec\u00edfico de DLCI.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/tty/n_gsm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"dd37f657387853623f20c1b2482afbb9cd8ece33\",\"lessThan\":\"81a4dd5e6c78f5d8952fa8c9d36565db1fe01444\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c568f7086c6e771c77aad13d727c70ef70e07243\",\"lessThan\":\"df6cfab66ff2a44bd23ad5dd5309cb3421bb6593\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c568f7086c6e771c77aad13d727c70ef70e07243\",\"lessThan\":\"19d34b73234af542cc8a218cf398dee73cdb1890\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c568f7086c6e771c77aad13d727c70ef70e07243\",\"lessThan\":\"ce4df90333c4fe65acb8b5089fdfe9b955ce976a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c568f7086c6e771c77aad13d727c70ef70e07243\",\"lessThan\":\"3a75b205de43365f80a33b98ec9289785da56243\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d834aba5f30d9a6f98f4ca1eb07e501f1989331c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"692e847a8e6607909c4a3f98ab16ccee7849bd11\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.61\",\"lessThan\":\"5.15.138\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.18.18\",\"lessThan\":\"5.19\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.19.2\",\"lessThan\":\"5.20\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/tty/n_gsm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.0\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.0\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.138\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.62\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.5.11\",\"lessThanOrEqual\":\"6.5.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.1\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-05-29T18:43:05.660039Z\",\"id\":\"CVE-2023-52872\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.61\",\"versionEndExcluding\":\"5.15.138\",\"matchCriteriaId\":\"C55F7228-0EE2-4555-82D4-444ECECA9456\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18.18\",\"versionEndExcluding\":\"5.19\",\"matchCriteriaId\":\"B60CAFE2-08C3-461B-B5F8-25BEB0C9853E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19.2\",\"versionEndExcluding\":\"6.1.62\",\"matchCriteriaId\":\"B2687C35-DACB-44F9-84FC-3F92072750F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.5.11\",\"matchCriteriaId\":\"F5531B4C-BC22-4135-B4CF-10C242D1E064\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6\",\"versionEndExcluding\":\"6.6.1\",\"matchCriteriaId\":\"7410F853-DEA4-430A-9EEB-9F88ED426353\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/19d34b73234af542cc8a218cf398dee73cdb1890\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a75b205de43365f80a33b98ec9289785da56243\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/81a4dd5e6c78f5d8952fa8c9d36565db1fe01444\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce4df90333c4fe65acb8b5089fdfe9b955ce976a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/df6cfab66ff2a44bd23ad5dd5309cb3421bb6593\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/19d34b73234af542cc8a218cf398dee73cdb1890\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a75b205de43365f80a33b98ec9289785da56243\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/81a4dd5e6c78f5d8952fa8c9d36565db1fe01444\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ce4df90333c4fe65acb8b5089fdfe9b955ce976a\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/df6cfab66ff2a44bd23ad5dd5309cb3421bb6593\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:23:43+00:00",
      "cve": "CVE-2023-52872",
      "id": "CVE-2023-52872",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tty: n_gsm: fix race condition in status line change on dead connections",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52872.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T02:27:53Z",
      "cve": "CVE-2023-52872",
      "id": "CVE-2023-52872",
      "initial_release_date": "2024-05-29T14:18:52Z",
      "product_status:known_affected": "275",
      "product_status:known_not_affected": "184",
      "product_status:recommended": "810",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52872",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52872.json",
      "version": "77"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/81a4dd5e6c78f5d8952fa8c9d36565db1fe01444\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/df6cfab66ff2a44bd23ad5dd5309cb3421bb6593\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/19d34b73234af542cc8a218cf398dee73cdb1890\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ce4df90333c4fe65acb8b5089fdfe9b955ce976a\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3a75b205de43365f80a33b98ec9289785da56243\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:11:36.237Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52872\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-29T18:43:05.660039Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-362\", \"description\": \"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-29T18:43:09.022Z\"}}], \"cna\": {\"title\": \"tty: n_gsm: fix race condition in status line change on dead connections\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is reached through local tty/pty operations: attach N_GSM0710 via TIOCSETD, configure with GSMIOC_SETCONF, and tear down the mux via close or reconfiguration\\u2014not via network packets.\\nAC:L - The attacker fully controls setup (including adaption=2 or basic encoding so gsm_modem_update queues data) and teardown; cleanup itself synchronously triggers the modem-status update that restarts the already-deleted kick_timer, so no external timing luck is required.\\nPR:L - Across the affected range (from the kick_timer introduction through the fix), attaching N_GSM0710 did not require CAP_NET_ADMIN until 67c37756898a; an unprivileged local user with a pty could open the ldisc, configure the mux, and trigger cleanup.\\nUI:N - Exploitation needs no victim action beyond the attacker\\u2019s own syscalls on tty/pty and gsmtty devices.\\nS:U - Impact stays within the host kernel authority; this is not a VM escape, IOMMU bypass, or other cross-boundary break.\\nC:H - Cleanup restarts kick_timer and can free gsm_mux (gsm_free_mux does not cancel that timer), yielding a timer use-after-free on gsm_mux that can be reclaimed and read for arbitrary kernel disclosure.\\nI:H - The same timer UAF on the freed gsm_mux object enables heap reuse and corruption of kernel control data (locks, DLCI pointers, TX state) for integrity compromise and potential code execution.\\nA:H - The dangling kick_timer and use of torn-down queues/DLCIs cause kernel oops/panic, as described in the fix, so availability impact is complete host denial of service.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"dd37f657387853623f20c1b2482afbb9cd8ece33\", \"lessThan\": \"81a4dd5e6c78f5d8952fa8c9d36565db1fe01444\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c568f7086c6e771c77aad13d727c70ef70e07243\", \"lessThan\": \"df6cfab66ff2a44bd23ad5dd5309cb3421bb6593\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c568f7086c6e771c77aad13d727c70ef70e07243\", \"lessThan\": \"19d34b73234af542cc8a218cf398dee73cdb1890\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c568f7086c6e771c77aad13d727c70ef70e07243\", \"lessThan\": \"ce4df90333c4fe65acb8b5089fdfe9b955ce976a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c568f7086c6e771c77aad13d727c70ef70e07243\", \"lessThan\": \"3a75b205de43365f80a33b98ec9289785da56243\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d834aba5f30d9a6f98f4ca1eb07e501f1989331c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"692e847a8e6607909c4a3f98ab16ccee7849bd11\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.15.61\", \"lessThan\": \"5.15.138\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.18.18\", \"lessThan\": \"5.19\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.19.2\", \"lessThan\": \"5.20\", \"versionType\": \"semver\"}], \"programFiles\": [\"drivers/tty/n_gsm.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.0\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.138\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.62\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.5.11\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.5.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/tty/n_gsm.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/81a4dd5e6c78f5d8952fa8c9d36565db1fe01444\"}, {\"url\": \"https://git.kernel.org/stable/c/df6cfab66ff2a44bd23ad5dd5309cb3421bb6593\"}, {\"url\": \"https://git.kernel.org/stable/c/19d34b73234af542cc8a218cf398dee73cdb1890\"}, {\"url\": \"https://git.kernel.org/stable/c/ce4df90333c4fe65acb8b5089fdfe9b955ce976a\"}, {\"url\": \"https://git.kernel.org/stable/c/3a75b205de43365f80a33b98ec9289785da56243\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntty: n_gsm: fix race condition in status line change on dead connections\\n\\ngsm_cleanup_mux() cleans up the gsm by closing all DLCIs, stopping all\\ntimers, removing the virtual tty devices and clearing the data queues.\\nThis procedure, however, may cause subsequent changes of the virtual modem\\nstatus lines of a DLCI. More data is being added the outgoing data queue\\nand the deleted kick timer is restarted to handle this. At this point many\\nresources have already been removed by the cleanup procedure. Thus, a\\nkernel panic occurs.\\n\\nFix this by proving in gsm_modem_update() that the cleanup procedure has\\nnot been started and the mux is still alive.\\n\\nNote that writing to a virtual tty is already protected by checks against\\nthe DLCI specific connection state.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.138\", \"versionStartIncluding\": \"5.15.61\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.62\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.5.11\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.1\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7\", \"versionStartIncluding\": \"6.0\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.18.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.19.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:11:46.257Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52872\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:11:46.257Z\", \"dateReserved\": \"2024-05-21T15:19:24.264Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-21T15:32:06.610Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.