CVE-2023-0590: Use After Free

Q: What is the severity of CVE-2023-0590?

CVE-2023-0590 is classified as a critical severity vulnerability due to its potential to cause denial-of-service.

Q: How do I fix CVE-2023-0590?

To fix CVE-2023-0590, upgrade to the recommended kernel versions provided by your distribution vendor, specifically those mentioned in the advisory.

Q: What causes the CVE-2023-0590 vulnerability?

CVE-2023-0590 is caused by a use-after-free flaw in the Linux Kernel's qdisc_graft function due to a race condition.

Q: Which Linux versions are affected by CVE-2023-0590?

CVE-2023-0590 affects certain versions of the Linux Kernel up to 6.1 and specific Red Hat kernel versions up to 5.14.0-284.11.1.

Q: Is CVE-2023-0590 a remote vulnerability?

CVE-2023-0590 is not designated as a remote vulnerability, but it can lead to denial-of-service attacks locally.

Published Oct 18, 2022

Updated

A use-after-free flaw was found in qdiscgraft in net/sched/schapi.c in the Linux Kernel due to a race problem leading to a denial-of-service problem.

Reference: https://lore.kernel.org/all/20221018203258.2793282-1-edumazet@google.com/

Crash: BUG: KASAN: use-after-free in tcfqdiscfind.part.0+0xa3a/0xac0 net/sched/clsapi.c:1066 Read of size 4 at addr ffff88802065e038 by task syz-executor.4/21027 CPU: 0 PID: 21027 Comm: syz-executor.4 Not tainted 6.0.0-rc3-syzkaller-00363-g7726d4c3e60b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Call Trace: <TASK> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0xcd/0x134 lib/dumpstack.c:106 printaddressdescription mm/kasan/report.c:317 [inline] printreport.cold+0x2ba/0x719 mm/kasan/report.c:433 kasanreport+0xb1/0x1e0 mm/kasan/report.c:495 tcfqdiscfind.part.0+0xa3a/0xac0 net/sched/clsapi.c:1066 tcfqdiscfind net/sched/clsapi.c:1051 [inline] tcnewtfilter+0x34f/0x2200 net/sched/clsapi.c:2018 rtnetlinkrcvmsg+0x955/0xca0 net/core/rtnetlink.c:6081 netlinkrcvskb+0x153/0x420 net/netlink/afnetlink.c:2501 netlinkunicastkernel net/netlink/afnetlink.c:1319 [inline] netlinkunicast+0x543/0x7f0 net/netlink/afnetlink.c:1345 netlinksendmsg+0x917/0xe10 net/netlink/afnetlink.c:1921 socksendmsgnosec net/socket.c:714 [inline] socksendmsg+0xcf/0x120 net/socket.c:734 syssendmsg+0x6eb/0x810 net/socket.c:2482 syssendmsg+0x110/0x1b0 net/socket.c:2536 syssendmsg+0xf3/0x1c0 net/socket.c:2565 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x35/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd RIP: 0033:0x7f5efaa89279

Other sources

A use-after-free flaw was found in qdiscgraft in net/sched/schapi.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 ("net: sched: fix race condition in qdiscgraft()") not applied yet, then kernel could be affected.

Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a use-after-free flaw in qdiscgraft in net/sched/schapi.c. An attacker could exploit this vulnerability to gain elevated privileges.

— IBM

Affected Software

137 affected componentsFixes available

redhat/kernel<0:4.18.0-372.75.1.el8_6

0:4.18.0-372.75.1.el8_6

redhat/kernel<0:5.14.0-284.11.1.el9_2

0:5.14.0-284.11.1.el9_2

redhat/kernel-rt<0:5.14.0-284.11.1.rt14.296.el9_2

0:5.14.0-284.11.1.rt14.296.el9_2

Linux Linux kernel<6.1

Linux Linux kernel=6.1-rc1

IBM Security Verify Governance, Identity Manager software component<=ISVG 10.0.2

IBM Security Verify Governance, Identity Manager virtual appliance component<=ISVG 10.0.2

debian/linux

5.10.223-15.10.234-16.1.129-16.1.135-16.12.25-1

redhat/linux kernel<6.1

6.1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-lts-xenial*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-hwe*

ubuntu/linux-azure*

ubuntu/linux-gcp*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm*

ubuntu/linux-oracle*

ubuntu/linux-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4<5.4.0-1107.115~18.04.1

5.4.0-1107.115~18.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-4.15*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4<5.4.0-1113.119~18.04.1

5.4.0-1113.119~18.04.1

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4<5.4.0-1110.119~18.04.1

5.4.0-1110.119~18.04.1

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4<5.4.0-156.173~18.04.1

5.4.0-156.173~18.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4<5.4.0-1054.59~18.04.1

5.4.0-1054.59~18.04.1

ubuntu/linux-kvm*

ubuntu/linux-oem*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4<5.4.0-1106.115~18.04.1

5.4.0-1106.115~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1091.102~18.04.1

5.4.0-1091.102~18.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-156.173

5.4.0-156.173

ubuntu/linux-aws<5.4.0-1107.115

5.4.0-1107.115

ubuntu/linux-aws-5.15<5.15.0-1030.34~20.04.1

5.15.0-1030.34~20.04.1

ubuntu/linux-azure<5.4.0-1114.120

5.4.0-1114.120

ubuntu/linux-azure-5.15<5.15.0-1033.40~20.04.1

5.15.0-1033.40~20.04.1

ubuntu/linux-bluefield<5.4.0-1068.74

5.4.0-1068.74

ubuntu/linux-gcp<5.4.0-1110.119

5.4.0-1110.119

ubuntu/linux-gcp-5.15<5.15.0-1029.36~20.04.1

5.15.0-1029.36~20.04.1

ubuntu/linux-gke<5.4.0-1105.112

5.4.0-1105.112

ubuntu/linux-gke-5.15<5.15.0-1027.32~20.04.1

5.15.0-1027.32~20.04.1

ubuntu/linux-gkeop<5.4.0-1074.78

5.4.0-1074.78

ubuntu/linux-gkeop-5.15<5.15.0-1015.19~20.04.1

5.15.0-1015.19~20.04.1

ubuntu/linux-hwe-5.15<5.15.0-60.66~20.04.1

5.15.0-60.66~20.04.1

ubuntu/linux-ibm<5.4.0-1054.59

5.4.0-1054.59

ubuntu/linux-intel-iotg-5.15<5.15.0-1025.30~20.04.1

5.15.0-1025.30~20.04.1

ubuntu/linux-iot<5.4.0-1019.20

5.4.0-1019.20

ubuntu/linux-kvm<5.4.0-1096.102

5.4.0-1096.102

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-60.66~20.04.1

5.15.0-60.66~20.04.1

ubuntu/linux-oracle<5.4.0-1106.115

5.4.0-1106.115

ubuntu/linux-oracle-5.15<5.15.0-1029.35~20.04.1

5.15.0-1029.35~20.04.1

ubuntu/linux-raspi<5.4.0-1091.102

5.4.0-1091.102

ubuntu/linux-riscv-5.15<5.15.0-1029.33~20.04.1

5.15.0-1029.33~20.04.1

ubuntu/linux-xilinx-zynqmp<5.4.0-1027.31

5.4.0-1027.31

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.8*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.8*

ubuntu/linux-intel-5.13*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.8*

ubuntu/linux-aws-fips<5.4.0-1107.115+fips1

5.4.0-1107.115+fips1

ubuntu/linux-azure-fips<5.4.0-1113.119+fips1

5.4.0-1113.119+fips1

ubuntu/linux-fips<5.4.0-1082.91

5.4.0-1082.91

ubuntu/linux-gcp-fips<5.4.0-1110.119+fips1

5.4.0-1110.119+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-60.66

5.15.0-60.66

ubuntu/linux-aws<5.15.0-1030.34

5.15.0-1030.34

ubuntu/linux-azure<5.15.0-1033.40

5.15.0-1033.40

ubuntu/linux-azure-fde<5.15.0-1033.40.1

5.15.0-1033.40.1

ubuntu/linux-gcp<5.15.0-1029.36

5.15.0-1029.36

ubuntu/linux-gke<5.15.0-1027.32

5.15.0-1027.32

ubuntu/linux-gkeop<5.15.0-1015.19

5.15.0-1015.19

ubuntu/linux-hwe-5.19<5.19.0-32.33~22.04.1

5.19.0-32.33~22.04.1

ubuntu/linux-ibm<5.15.0-1025.28

5.15.0-1025.28

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1025.30

5.15.0-1025.30

ubuntu/linux-kvm<5.15.0-1028.33

5.15.0-1028.33

ubuntu/linux-lowlatency<5.15.0-60.66

5.15.0-60.66

ubuntu/linux-nvidia<5.15.0-1017.17

5.15.0-1017.17

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0<6.0.0-1008.8

6.0.0-1008.8

ubuntu/linux-oracle<5.15.0-1029.35

5.15.0-1029.35

ubuntu/linux-raspi<5.15.0-1024.26

5.15.0-1024.26

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-bluefield<5.15.0-1014.16

5.15.0-1014.16

ubuntu/linux-raspi-realtime*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 0:4.18.0-372.75.1.el8_6
Upgrade
Upgrade redhat/kernel to a version that resolves this vulnerability.
Fixed in 0:5.14.0-284.11.1.el9_2
Upgrade
Upgrade redhat/kernel-rt to a version that resolves this vulnerability.
Fixed in 0:5.14.0-284.11.1.rt14.296.el9_2
Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Upgrade
Upgrade redhat/Linux kernel to a version that resolves this vulnerability.
Fixed in 6.1
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1107.115~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1113.119~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1110.119~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-156.173~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1054.59~18.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1106.115~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1091.102~18.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-156.173
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1107.115
Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1030.34~20.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1114.120
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1033.40~20.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1068.74
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1110.119
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1029.36~20.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.4.0-1105.112
Upgrade
Upgrade ubuntu/linux-gke-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1027.32~20.04.1
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.4.0-1074.78
Upgrade
Upgrade ubuntu/linux-gkeop-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1015.19~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-60.66~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1054.59
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1025.30~20.04.1
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1019.20
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1096.102
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-60.66~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1106.115
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1029.35~20.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1091.102
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1029.33~20.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.4.0-1027.31
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1107.115+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1113.119+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1082.91
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1110.119+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-60.66
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1030.34
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1033.40
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1033.40.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1029.36
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1027.32
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1015.19
Upgrade
Upgrade ubuntu/linux-hwe-5.19 to a version that resolves this vulnerability.
Fixed in 5.19.0-32.33~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1025.28
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1025.30
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1028.33
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-60.66
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1017.17
Upgrade
Upgrade ubuntu/linux-oem-6.0 to a version that resolves this vulnerability.
Fixed in 6.0.0-1008.8
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1029.35
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1024.26
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1014.16
Upgrade
Upgrade Linux kernel to a version that resolves this vulnerability.
Patch ebda44da44f6

Event History

Oct 18, 2022

CVE Published

06:30 AM

Jan 30, 2023

Data Sourced

via Red Hat·09:49 PM

DescriptionSeverityAffected Software

Feb 1, 2023

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Mar 23, 2023

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is the severity of CVE-2023-0590?

CVE-2023-0590 is classified as a critical severity vulnerability due to its potential to cause denial-of-service.

How do I fix CVE-2023-0590?

To fix CVE-2023-0590, upgrade to the recommended kernel versions provided by your distribution vendor, specifically those mentioned in the advisory.

What causes the CVE-2023-0590 vulnerability?

CVE-2023-0590 is caused by a use-after-free flaw in the Linux Kernel's qdisc_graft function due to a race condition.

Which Linux versions are affected by CVE-2023-0590?

CVE-2023-0590 affects certain versions of the Linux Kernel up to 6.1 and specific Red Hat kernel versions up to 5.14.0-284.11.1.

Is CVE-2023-0590 a remote vulnerability?

CVE-2023-0590 is not designated as a remote vulnerability, but it can lead to denial-of-service attacks locally.

CVE-2023-0590: Use After Free

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

What is the severity of CVE-2023-0590?

How do I fix CVE-2023-0590?

What causes the CVE-2023-0590 vulnerability?

Which Linux versions are affected by CVE-2023-0590?

Is CVE-2023-0590 a remote vulnerability?

Company

Resources

Contact