CVE-2023-4611: Use after free race between mbind() and vma-locked page fault

Q: Who can exploit this issue?

Exploitation requires local access and low privileges. The attacker must be able to trigger the race between mbind() and a VMA-locked page fault; no user interaction is required.

Q: What impact could successful exploitation have?

A successful race may crash the system, causing a denial of service. It may also expose kernel information through an information leak; the provided data does not describe an integrity impact.

Q: Is exploitation straightforward?

The CVSS vector rates attack complexity as high, indicating that exploiting the issue depends on winning a race condition rather than reliably invoking a single operation.

Published Jul 28, 2023

Updated

A use-after-free flaw was found in mm/mempolicy.c in memory management subsystem in the Linux Kernel. This problem is caused by a race between mbind() and VMA-locked page fault, where a local attacker may crash the system, this flaw could even lead to a kernel information leak threat.

Refer: https://www.spinics.net/lists/stable-commits/msg310136.html

Other sources

A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbind() and VMA-locked page fault, and may allow a local attacker to crash the system or lead to a kernel information leak.

— NVD

Affected Software

6 affected componentsFixes available

Linux Linux kernel<6.5

Linux Linux kernel=6.5-rc1

Linux Linux kernel=6.5-rc2

Linux Linux kernel=6.5-rc3

redhat/Kernel<6.5

6.5

Linux Linux kernel>=6.4<6.4.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/Kernel to a version that resolves this vulnerability.
Fixed in 6.5

Event History

Jul 28, 2023

Data Sourced

via Red Hat·01:44 PM

DescriptionSeverityAffected Software

Aug 29, 2023

CVE Published

via MITRE·09:25 PM

Data Sourced

via MITRE·09:25 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

Exploitation requires local access and low privileges. The attacker must be able to trigger the race between mbind() and a VMA-locked page fault; no user interaction is required.

What impact could successful exploitation have?

A successful race may crash the system, causing a denial of service. It may also expose kernel information through an information leak; the provided data does not describe an integrity impact.

Is exploitation straightforward?

The CVSS vector rates attack complexity as high, indicating that exploiting the issue depends on winning a race condition rather than reliably invoking a single operation.

CVE-2023-4611: Use after free race between mbind() and vma-locked page fault

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What impact could successful exploitation have?

Is exploitation straightforward?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What impact could successful exploitation have?

Is exploitation straightforward?