CVE-2023-0266

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. The issue is related to missing locks in SNDRV CTL IOCTL ELEM {READ|WRITE}32 that can be used in a use-after-free, resulting in a privilege escalation to gain ring0 access from the system user. The vulnerability can be exploited to cause a denial of service and gain unauthorized access to protected information. It has been found exploited in the wild, affecting Linux systems.

Recommendations To resolve the issue, upgrade past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e. As a temporary workaround, consider restricting access to the vulnerable SNDRV CTL IOCTL ELEM {READ|WRITE}32 API endpoint to minimize the risk of exploitation.