CVE-2023-0461

Published Feb 28, 2023

Last updated 2 years ago

CVSS high 7.8

Overview

Description: There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c
Source: cve-coordination@google.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-416
cve-coordination@google.com: CWE-416

Hype score: Not currently trending

#exploit 1. CVE-2023-6932, CVE-2023-0461: UaF/LPE in Linux kernel https://t.co/OOfZ4dy95Q 2. CVE-2024-53141: An OOB Write Vulnerability in Netfiler Ipset https://t.co/rVzuElL9KO 3. CVE-2024-50603: Aviatrix Network Controller Command Injection Vulnerability… https://t.co/s0jItYw
@ksg93rd
9 Jan 2025
62 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D375FAEB-F480-4787-A5D8-E1012F3089DE",
            "versionEndExcluding": "4.14.303",
            "versionStartIncluding": "4.13.0"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E60D856E-8039-4750-B1B9-7A01D40BBCE6",
            "versionEndExcluding": "4.19.270",
            "versionStartIncluding": "4.19"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E4A27F20-0847-4A4D-8BF9-1EE6B2E80E41",
            "versionEndExcluding": "5.4.229",
            "versionStartIncluding": "5.4"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CE4DEDD1-2BE5-40F9-8FBB-C0E7E01EF072",
            "versionEndExcluding": "5.10.163",
            "versionStartIncluding": "5.10"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BEB9094F-84DB-4514-BCD4-B815185BBBF5",
            "versionEndExcluding": "5.15.88",
            "versionStartIncluding": "5.15"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7E070665-7647-450B-AB3D-C01637029C9D",
            "versionEndExcluding": "6.0.19",
            "versionStartIncluding": "6.0"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8C1E7766-4310-43F9-BAC4-3763A36C043A",
            "versionEndExcluding": "6.1.5",
            "versionStartIncluding": "6.1"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FF501633-2F44-4913-A8EE-B021929F49F6"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2BDA597B-CAC1-4DF0-86F0-42E142C654E9"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

References