CVE-2023-6531: Kernel: gc's deletion of an skb races with unix_stream_read_generic() leading to uaf
A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unixstreamreadgeneric() on the socket that the SKB is queued on.
Other sources
If the Unix GC's deletion of an SKB races with unixstreamreadgeneric() on the socket that the SKB was queued up on, we get a race condition, leading to UAF, because it is supposed to be impossible to run these operations in parallel on the same socket:
- unixstreamreadgeneric() assumes that mutexlock(&u->iolock) protects sk->skreceivequeue against element removal, so it holds a pointer to an SKB on the sk->skreceivequeue without any other protection - scaninflight() only takes spinlock(&x->skreceivequeue.lock) when stealing SKBs from the skreceivequeue
— Red Hat
Kernel: gc's deletion of an skb races with unixstreamreadgeneric() leading to uaf
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/Kernelto a version that resolves this vulnerability.Fixed in 6.7
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6531?
CVE-2023-6531 has been assessed as a high severity vulnerability due to the potential for use-after-free errors.
How do I fix CVE-2023-6531?
To mitigate CVE-2023-6531, upgrade the Linux kernel to version 6.8 or later, or apply the respective patches provided by your distribution.
What systems are affected by CVE-2023-6531?
CVE-2023-6531 affects Linux kernel versions up to 6.7 and specific releases such as Red Hat Enterprise Linux 9.0.
What is the impact of CVE-2023-6531?
The impact of CVE-2023-6531 may lead to a kernel crash or unauthorized access, compromising system integrity.
Is CVE-2023-6531 being actively exploited?
As of the current date, there is no reported active exploitation of CVE-2023-6531, but caution is advised until patches are applied.