CVE-2023-1076: Medium severity Linux Linux kernel vulnerability
A flaw found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAPNETADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters.
References: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=66b2c338adce580dfce2199591e65e2bab889cff https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=a096ccca6e503a5c575717ff8a36ace27510ab0a
Other sources
A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAPNETADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1076?
CVE-2023-1076 has a high severity rating due to a vulnerability in the Linux Kernel affecting tun/tap sockets.
How do I fix CVE-2023-1076?
To fix CVE-2023-1076, upgrade to kernel version 6.1.16 or apply the relevant patches available for affected distributions.
Which versions of Linux Kernel are affected by CVE-2023-1076?
CVE-2023-1076 affects multiple versions including pre-6.1.16 and specific versions in the 5.10 and 6.x series without the patch.
Under what conditions does CVE-2023-1076 pose a risk?
CVE-2023-1076 poses a risk particularly when non-root users gain unintended access through tun/tap socket misuse.
What is the root cause of CVE-2023-1076?
The root cause of CVE-2023-1076 is a type confusion in the initialization function for tun/tap sockets leading to hard-coded UID issues.