CVE-2023-0461: Use-after-free vulnerability in the Linux Kernel
A use-after-free flaw was found in the Linux kernel’s TLS protocol functionality in how a user installs a tls context (struct tlscontext) on a connected TCP socket. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Other sources
NVD description: There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIGTLS or CONFIGXFRMESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icskulpdata of a struct inetconnectionsock. When CONFIGTLS is enabled, user can install a tls context (struct tlscontext) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCPULP operation does not require any privilege.
Upstream commit: https://github.com/torvalds/linux/commit/2c02d41d71f90a5168391b6a5f2954112ba2307c
— Red Hat
There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIGTLS or CONFIGXFRMESPINTCP has to be configured, but the operation does not require any privilege.
There is a use-after-free bug of icskulpdata of a struct inetconnectionsock.
When CONFIGTLS is enabled, user can install a tls context (struct tlscontext) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable.
The setsockopt TCPULP operation does not require any privilege.
We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c
— MITRE
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2023-0461?
CVE-2023-0461 is classified as a high-severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2023-0461?
To fix CVE-2023-0461, update your Linux kernel to version 4.18.0-477.10.1.rt7.274.el8_8 or later.
Which Linux kernel versions are affected by CVE-2023-0461?
CVE-2023-0461 affects Linux kernel versions prior to 4.18.0-477.10.1.rt7.274.el8_8.
Can CVE-2023-0461 be exploited remotely?
CVE-2023-0461 primarily allows local users to exploit the vulnerability, rather than being remotely exploitable.
What impact does CVE-2023-0461 have on system integrity?
CVE-2023-0461 can cause system crashes and potentially allow local users to escalate their privileges on the system.