CVE-2023-0468: Use After Free
A use-after-free flaw was found in iouring/poll.c in iopollcheckevents in the iouring subcomponent in the Linux Kernel due to a race condition of pollrefs. This flaw may cause a NULL pointer dereference.
Other sources
There is a race condition problem ok pollrefs which could result in a NULL pointer dereference.
The crash trace is like: KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 30781 Comm: syz-executor.2 Not tainted 6.0.0-g493ffd6605b2 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:iopollremoveentry iouring/poll.c:154 [inline] RIP: 0010:iopollremoveentries+0x171/0x5b4 iouring/poll.c:190 Code: ... RSP: 0018:ffff88810dfefba0 EFLAGS: 00010202 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000040000 RDX: ffffc900030c4000 RSI: 000000000003ffff RDI: 0000000000040000 RBP: 0000000000000008 R08: ffffffff9764d3dd R09: fffffbfff3836781 R10: fffffbfff3836781 R11: 0000000000000000 R12: 1ffff11003422d60 R13: ffff88801a116b04 R14: ffff88801a116ac0 R15: dffffc0000000000 FS: 00007f9c07497700(0000) GS:ffff88811a600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffb5c00ea98 CR3: 0000000105680005 CR4: 0000000000770ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ioapolltaskfunc+0x3f/0xa0 iouring/poll.c:299 handletwlist iouring/iouring.c:1037 [inline] tctxtaskwork+0x37e/0x4f0 iouring/iouring.c:1090 taskworkrun+0x13a/0x1b0 kernel/taskwork.c:177 getsignal+0x2402/0x25a0 kernel/signal.c:2635 archdosignalorrestart+0x3b/0x660 arch/x86/kernel/signal.c:869 exittousermodeloop kernel/entry/common.c:166 [inline] exittousermodeprepare+0xc2/0x160 kernel/entry/common.c:201 syscallexittousermodework kernel/entry/common.c:283 [inline] syscallexittousermode+0x58/0x160 kernel/entry/common.c:294 entrySYSCALL64afterhwframe+0x63/0xcd
Reference: https://github.com/torvalds/linux/commit/12ad3d2d6c5b0131a6052de91360849e3e154846 https://github.com/torvalds/linux/commit/a26a35e9019fd70bf3cf647dcfdae87abc7bacea
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 6.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0468?
CVE-2023-0468 is considered a high severity vulnerability due to the potential for NULL pointer dereference.
How do I fix CVE-2023-0468?
To fix CVE-2023-0468, update to Linux Kernel version 6.1 or apply the relevant patches from your distribution.
What systems are affected by CVE-2023-0468?
CVE-2023-0468 affects Linux Kernel versions up to 6.1, including several release candidates.
What causes the vulnerability CVE-2023-0468?
CVE-2023-0468 is caused by a use-after-free flaw due to a race condition in the io_uring/poll.c component.
Is CVE-2023-0468 being actively exploited?
As of now, there is no confirmation of active exploitation of CVE-2023-0468, but it is advisable to apply patches promptly.