Vulnerability in Linux

CVE-2023-53839

In the Linux kernel, the following vulnerability has been resolved: dccp: fix data-race around dp->dccps_mss_cache dccp_sendmsg() reads dp->dccps_mss_cache before locking the socket. Same thing in do_dccp_getsockopt(). Add READ_ONCE()/WRITE_ONCE() annotations, and change dccp_sendmsg() to check again dccps_mss_cache after socket is locked.

EPSS: 0.002 (13.9th percentile) — read the EPSS interpretation.

Affected products

  • Linux — versions 7c657876b63cb1d8a2ec06f8fc6c37bb8412e66c, 2.6.14, 0

References