Security readout for executives and security teams
Plain-English summary
CVE-2023-52922 is a Linux kernel use-after-free bug in the CAN BCM networking subsystem. A local user could trigger unsafe access to freed kernel memory. The CVSS score is high, but the record does not show known active exploitation or remote attack capability.
Executive priority
Treat as a high-priority kernel maintenance issue, especially on multi-user Linux systems or embedded environments using CAN. It is not currently evidenced as internet-remote or actively exploited in the supplied sources.
Technical view
The issue is CWE-416 in bcm_proc_show(). The CVE states bcm_op can be freed before its procfs entry is removed in bcm_release(), allowing bcm_proc_show() to read freed memory. CVSS 3.1 is 7.8 with local attack vector, low complexity, low privileges, no user interaction, and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most relevant to Linux systems running affected kernel versions where CAN BCM is present and local users or local workloads can interact with the subsystem. The provided record lists Linux as affected across multiple kernel lines and references stable kernel fixes.
Exploitation context
The attack vector is local and requires low privileges. The supplied sources include a KASAN crash trace and technical description, but do not establish active exploitation. CISA KEV status in the bundle is false.
Researcher notes
The root cause is lifetime ordering: bcm_op is freed before the procfs entry is removed, so bcm_proc_show() may dereference freed memory. The public description includes KASAN evidence on Linux 6.5-rc1 and stable backport commit references.
Mitigation direction
- Upgrade to a vendor kernel containing the referenced stable Linux fixes.
- Review Linux distribution advisories for backported fixes and supported package versions.
- Prioritize shared systems where untrusted local users or workloads are present.
- If CAN BCM is unnecessary, ask the vendor whether disabling it is supported.
Validation and detection
- Inventory Linux kernel versions across servers, appliances, and embedded systems.
- Compare installed kernels against vendor advisories for CVE-2023-52922.
- Confirm the relevant stable fix appears in kernel changelogs or package metadata.
- Identify systems exposing CAN or SocketCAN functionality to local users or workloads.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-52922 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/11b8e27ed448baa385d90154a141466bd5e92f18CVE reference, Linux
- https://git.kernel.org/stable/c/9b58d36d0c1ea29a9571e0222a9c29df0ccfb7ffCVE reference, Linux
- https://git.kernel.org/stable/c/9533dbfac0ff7edd77a5fa2c24974b1d66c8b0a6CVE reference, Linux
- https://git.kernel.org/stable/c/cf254b4f68e480e73dab055014e002b77aed30edCVE reference, Linux
- https://git.kernel.org/stable/c/3c3941bb1eb53abe7d640ffee5c4d6b559829ab3CVE reference, Linux
- https://git.kernel.org/stable/c/995f47d76647708ec26c6e388663ad4f3f264787CVE reference, Linux
- https://git.kernel.org/stable/c/dfd0aa26e9a07f2ce546ccf8304ead6a2914e8a7CVE reference, Linux
- https://git.kernel.org/stable/c/55c3b96074f3f9b0aee19bf93cd71af7516582bbCVE reference, Linux
- https://allelesecurity.com/use-after-free-vulnerability-in-can-bcm-subsystem-leading-to-information-disclosure-cve-2023-52922/CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.