CVE-2023-52702: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52702 is a memory leak vulnerability discovered in the Linux kernel's OpenVSwitch component, specifically in the ovs_meter_cmd_set() function. The vulnerability was identified and disclosed on May 21, 2024, affecting Linux kernel versions from 5.8 through 6.2-rc8. The issue occurs when old_meter needs to be freed after it is detached, regardless of whether the new meter is successfully attached (NVD).

The vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) with a CVSS v3.1 Base Score of 5.5 (Medium). The issue specifically affects the net/openvswitch/meter.c file where a memory leak can occur during meter command operations. The technical fix involves ensuring proper memory deallocation by adding an exit_free_old_meter label and calling ovs_meter_free(old_meter) before the exit_unlock sequence (Kernel Patch).

The vulnerability can lead to memory leaks in the Linux kernel's OpenVSwitch component, potentially causing system resource depletion over time. While the impact is limited to availability (no confidentiality or integrity impacts), it could affect system performance and stability in environments using OpenVSwitch meter functionality (NVD).

The vulnerability requires local access with low complexity and low privileges to exploit. There is no need for user interaction to trigger the issue. The attack vector is local, making it less severe from a remote exploitation perspective (NVD).

The vulnerability has been patched in the Linux kernel. The fix involves properly freeing the old_meter after it is detached, regardless of whether the new meter is successfully attached. Users should update to the patched versions of the Linux kernel. The fix has been backported to affected stable kernel versions (Kernel Patch).