CVE catalog

CVE-2023-37454

linux: CVE-2023-37454

Severity: Medium
Published: Jul 6, 2023, 5:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.36% · Oct 25, 2026

An issue was discovered in the Linux kernel through 6.4.2. A crafted UDF filesystem image causes a use-after-free write operation in the udf_put_super and udf_close_lvid functions in fs/udf/super.c. NOTE: the suse.com reference has a different perspective about this.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	linux	sid	`7.2.12-1`	vulnerable
Debian	linux	forky	`7.2.12-1`	vulnerable
Debian	linux	trixie	`6.12.107-1`	vulnerable
Debian	linux	trixie-security	`6.12.113-1`	vulnerable
Debian	linux	bookworm	`6.1.176-1`	vulnerable
Debian	linux	bookworm-security	`6.1.190-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	linux	source	sid	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	linux	source	forky	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	linux	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	linux	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]