Race Condition in GSM 0710 Tty Multiplexor Could Lead to Privilege Escalation

CVE-2023-6546
7HIGH

Key Information

Vendor
Red Hat
Status
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 8.2 Advanced Update Support
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat Enterprise Linux 8.4 Telecommunications Update Service
Vendor
CVE Published:
21 December 2023

Badges

👾 Exploit Exists📰 News Worthy

Summary

A race condition vulnerability (CVE-2023-6546) has been identified in the GSM 0710 tty multiplexor in the Linux kernel, which could allow a local unprivileged user to escalate their privileges on the system. A proof-of-concept exploit for this vulnerability has been released, posing a high risk of a Linux system takeover. The exploitation of this vulnerability can lead to severe consequences, including unauthorized access, system compromise, and potential data breaches. It is crucial for affected organizations to upgrade to the fixed version (18.12.11) promptly to mitigate the risk.

Affected Version(s)

Red Hat Enterprise Linux 8 <= 0:4.18.0-513.24.1.rt7.326.el8_9

Red Hat Enterprise Linux 8 <= 0:4.18.0-513.24.1.el8_9

Red Hat Enterprise Linux 8.2 Advanced Update Support <= 0:4.18.0-193.136.1.el8_2

News Articles

favicon imageKali Linux Tutorials

Linux Kernel CVE-2023-6546 - Unveiling A Critical Vulnerability

This is a custom exploit which targets Ubuntu 18.04+20.04 LTS/Centos 8/RHEL 8 to attain root privileges via arbitrary kernel code

8 months ago

favicon imagePenetration Testing

CVE-2023-6546 Archives

VulnerabilityJanuary 16, 2024CVE-2023-6546 PoC Exploit: A Gateway to Linux System TakeoverA cybersecurity researcher, Nassim Asrir has released the details, and a proof-of-concept (PoC) exploit for a...

8 months ago

favicon imageGitHub

CVE-2023-6546/ZDI-24-020 — Linux LPE · Issue #18719 · rapid7/metasploit-framework

Summary Linux Kernel GSM Multiplexing Race Condition Local Privilege Escalation Vulnerability (CVE-2023-6546), by @Nassim-Asrir Basic example https://github.com/Nassim-Asrir/ZDI-24-020 $ gcc exploit.c -o exploit -lpthread $ ./exploit [+]...

8 months ago

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit exists.

  • First article discovered by RedPacket Security

  • Vulnerability published.

  • Reported to Red Hat.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database5 News Article(s)
.