CVE-2023-2612

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-667

Affected software

VendorProductVersions
Canonical Ltd.ubuntu-linux< 02b47547824b1cd0d55c6744f91886f04de8947e

References

Timeline

Published
May 31, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-261206.1This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add anCVE-2023-2612110.0All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its pCVE-2023-2612210.0All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived fromCVE-2023-261236.1Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does notCVE-2023-261257.3Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a sCVE-2023-261265.3All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested viCVE-2023-261277.8All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function. *CVE-2023-261287.8All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sanCVE-2023-261297.8All versions of the package bwm-ng are vulnerable to Command Injection due to improper input sanitization in the 'check' function in the bwmCVE-2023-261308.8Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the contCVE-2023-261316.1All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerablCVE-2023-261327.5Versions of the package dottie before 2.0.4 are vulnerable to Prototype Pollution due to insufficient checks, via the set() function and the
CVE-2023-2612: Medium severity, CVSS 4.7 | Vulnix