Linux Kernel use after free

Summaryinfo

A vulnerability classified as critical was found in Linux Kernel. This impacts an unknown function. Executing a manipulation can lead to use after free. This vulnerability is handled as CVE-2023-0461. It is possible to launch the attack on the local host. There is not any exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in Linux Kernel (Operating System) (version unknown). It has been declared as critical. This vulnerability affects an unknown function. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c

The weakness was released 02/28/2023. The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2023-0461 since 01/24/2023. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 236642 (Alibaba Cloud Linux 3 : 0042: cloud-kernel bugfix, enhancement and (ALINUX3-SA-2023:0042)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.kernel.org.

The vulnerability is also documented in the vulnerability database at Tenable (236642). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion