CVE-2023-2007

Name	CVE-2023-2007
Description	The specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3508-1, DLA-3623-1, DSA-5480-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
linux (PTS)	bullseye	5.10.223-1	fixed
	bullseye (security)	5.10.234-1	fixed
	bookworm	6.1.137-1	fixed
	bookworm (security)	6.1.135-1	fixed
	trixie, sid	6.12.27-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
linux	source	buster	4.19.289-1	DLA-3508-1
linux	source	bullseye	5.10.191-1	DSA-5480-1
linux	source	(unstable)	6.0.2-1
linux-5.10	source	buster	5.10.197-1~deb10u1	DLA-3623-1

https://git.kernel.org/linus/b04e75a4a8a81887386a0d2dbf605a48e779d2a0 (6.0-rc1)