CVE-2023-0590: Use After Free
First published: Tue Oct 18 2022(Updated: )
A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem leading to a denial-of-service problem. Reference: <a href="https://lore.kernel.org/all/20221018203258.2793282-1-edumazet@google.com/">https://lore.kernel.org/all/20221018203258.2793282-1-edumazet@google.com/</a> Crash: BUG: KASAN: use-after-free in __tcf_qdisc_find.part.0+0xa3a/0xac0 net/sched/cls_api.c:1066 Read of size 4 at addr ffff88802065e038 by task syz-executor.4/21027 CPU: 0 PID: 21027 Comm: syz-executor.4 Not tainted 6.0.0-rc3-syzkaller-00363-g7726d4c3e60b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 __tcf_qdisc_find.part.0+0xa3a/0xac0 net/sched/cls_api.c:1066 __tcf_qdisc_find net/sched/cls_api.c:1051 [inline] tc_new_tfilter+0x34f/0x2200 net/sched/cls_api.c:2018 rtnetlink_rcv_msg+0x955/0xca0 net/core/rtnetlink.c:6081 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2482 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f5efaa89279
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel | <0:4.18.0-372.75.1.el8_6 | 0:4.18.0-372.75.1.el8_6 |
| redhat/kernel | <0:5.14.0-284.11.1.el9_2 | 0:5.14.0-284.11.1.el9_2 |
| redhat/kernel-rt | <0:5.14.0-284.11.1.rt14.296.el9_2 | 0:5.14.0-284.11.1.rt14.296.el9_2 |
| Linux Linux kernel | <6.1 | |
| Linux Linux kernel | =6.1-rc1 | |
| redhat/Linux kernel | <6.1 | 6.1 |
| IBM QRadar SIEM | <=7.5 - 7.5.0 UP8 IF01 | |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.123-1 6.1.119-1 6.12.9-1 6.12.10-1 |
Remedy
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2023-0590 https://nvd.nist.gov/vuln/detail/CVE-2023-0590 https://lore.kernel.org/all/20221018203258.2793282-1-edumazet@google.com/
- https://bugzilla.redhat.com/show_bug.cgi?id=2165741
- https://access.redhat.com/errata/RHSA-2023:5627
- https://access.redhat.com/errata/RHSA-2023:2458
- https://access.redhat.com/errata/RHSA-2023:2148
- https://access.redhat.com/security/cve/cve-2023-0590
- https://lore.kernel.org/all/20221018203258.2793282-1-edumazet@google.com/
- https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
- https://lore.kernel.org/all/20221018203258.2793282-1-edumazet%40google.com/
- https://access.redhat.com/errata/RHSA-2023:6901
- https://access.redhat.com/errata/RHSA-2023:7077
- https://access.redhat.com/errata/RHSA-2023:7389
- https://access.redhat.com/errata/RHSA-2023:7382
- https://launchpad.net/bugs/cve/CVE-2023-0590
- https://exchange.xforce.ibmcloud.com/vulnerabilities/250827
- https://www.ibm.com/support/pages/node/7150684 (Advisory)
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0590
- https://nvd.nist.gov/vuln/detail/CVE-2023-0590
- https://security-tracker.debian.org/tracker/CVE-2023-0590
- https://ubuntu.com/security/CVE-2023-0590
- https://git.kernel.org/linus/ebda44da44f6f309d302522b049f43d6f829f7aa
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-cve
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/author
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-0590
- collector/launchpad-cve
- source/Launchpad
- agent/weakness
- collector/ibm-support
- source/IBM
- agent/severity
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- collector/nvd-cve
- agent/remedy
- agent/references
- agent/last-modified-date
- agent/description
- agent/event
- agent/trending
- agent/tags
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/source
- package-manager/redhat
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/6.1-rc1
- vendor/ibm
- canonical/ibm qradar siem
- version/ibm qradar siem/7.5 - 7.5.0 up8 if01
- package-manager/debian