CVE-2023-2612
Canonical Ubuntu Linux 20.04 … 22.10
Raw vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-2612 is a medium-severity Improper Locking (CWE-667) vulnerability in Canonical Ubuntu Linux. Its CVSS base score is 4.4 (Medium).
Operationally, ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-34086
Vulnerability Data
Jean-Baptiste Cayrou discovered that the shiftfs file system in the Ubuntu Linux kernel contained a race condition when handling inode locking in some situations. A local attacker could use this to cause a denial of service (kernel deadlock).
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development lifecycle includes concurrency and locking requirements that reduce improper locking defects.
A.8.26 only requires that security requirements (including resilience against attacks such as buffer overflows or SQL injection) be identified and specified during development or acquisition; it does not itself enforce, implement, or prevent improper locking from being present or exploitable in the resulting application.
Secure architecture principles address thread-safety and resource synchronization.
Secure coding standards directly prohibit missing or incorrect lock usage.
Security testing can detect race conditions and locking errors before release.
Change management may catch locking issues introduced by modifications but does not prevent the weakness itself.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-667, a class-level weakness, and none of its children carries one either.