{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2023-52880",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2023-52880"
  ],
  "published": "2024-05-24T15:33:29Z",
  "summary": "tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc\n\nAny unprivileged user can attach N_GSM0710 ldisc, but it requires\nCAP_NET_ADMIN to create a GSM network anyway.\n\nRequire initial namespace CAP_NET_ADMIN to do that.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.86",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52880"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/7d303dee473ba3529d75b63491e9963342107bed"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/7a529c9023a197ab3bf09bb95df32a3813f7ba58"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ada28eb4b9561aab93942f3224a2e41d76fe57fa"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2d154a54c58f9c8375bfbea9f7e51ba3bfb2e43a"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/2b85977977cbd120591b23c2450e90a5806a7167"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/67c37756898a5a6b2941a13ae7260c89b54e0d88"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T11:24:39Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - Exploitation is entirely local: an attacker opens a pty (/dev/ptmx), issues ioctl(TIOCSETD, N_GSM0710) \u2192 tiocsetd \u2192 tty_set_ldisc \u2192 gsmld_open, then drives GSMIOC_SETCONF and frame I/O on that tty. There is no network-facing or adjacent-link path into this code.\nAC:L - Attaching the ldisc and configuring the mux is fully attacker-controlled and deterministic on a self-owned pty, with no race or other condition outside the attacker\u2019s influence.\nPR:L - Before the fix, gsmld_open had no capability check, so any unprivileged local user with a pty could attach N_GSM0710; CAP_NET_ADMIN was only required later for GSMIOC_ENABLE_NET, not for attach/configure.\nUI:N - The attacker performs openpty, TIOCSETD, GSMIOC_SETCONF, and subsequent I/O entirely in their own process; no victim action is required.\nS:U - Impact remains within the host kernel\u2019s security authority as a local privilege-escalation/DoS boundary; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Unprivileged attach exposes the full n_gsm mux/parser heap paths; throughout this CVE\u2019s lifetime the same entry path enabled serious memory-corruption bugs (e.g. CVE-2024-36016 heap OOB readable via DLCI/tty paths, timer/cleanup UAFs), yielding kernel disclosure primitives.\nI:H - The same exposed attach/configure/cleanup surface enables heap overflow and use-after-free write primitives against adjacent slab objects and gsm_mux control state, supporting arbitrary write and control-flow hijack.\nA:H - Abusing the unprivileged mux attach/teardown and parser paths reliably corrupts kernel state and triggers oops/panic (as seen in related n_gsm KASAN/oops reports), fully denying host availability."
    }
  }
}