CVE-2023-0461

There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIGTLS or CONFIGXFRM_ESPINTCP has to be configured, but the operation does not require any privilege.

There is a use-after-free bug of icskulpdata of a struct inetconnectionsock.

When CONFIGTLS is enabled, user can install a tls context (struct tlscontext) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable.

The setsockopt TCP_ULP operation does not require any privilege.

We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c

References

Affected packages

Git /

Affected ranges

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-0461.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "4.13.0"
            },
            {
                "fixed": "4.14.303"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "4.19"
            },
            {
                "fixed": "4.19.270"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.4"
            },
            {
                "fixed": "5.4.229"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.10"
            },
            {
                "fixed": "5.10.163"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "5.15"
            },
            {
                "fixed": "5.15.88"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "6.0"
            },
            {
                "fixed": "6.0.19"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "6.1"
            },
            {
                "fixed": "6.1.5"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.2-rc1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "6.2-rc2"
            }
        ]
    }
]