Bug 2179000 (CVE-2023-28466)

Summary:	CVE-2023-28466 kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, allarkin, bhu, chwhite, crwood, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, fhrbata, hkrzesin, jarod, jburrell, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, kyoshida, lgoncalv, lzampier, mcascell, nmurray, ptalbert, qzhao, rogbas, rvrbovsk, scweaver, tyberry, vkumar, walters, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.3-rc2	Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free flaw was found in the do_tls_getsockopt function in net/tls/tls_main.c in the Transport Layer Security (TLS) in the Network subcompact in the Linux kernel. This flaw allows an attacker to cause a NULL pointer dereference problem due to a race condition.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2179814, 2179815, 2179816, 2179817, 2179818, 2179819, 2179820, 2179821, 2179822, 2179823, 2179824, 2179825, 2184152, 2184153, 2187959, 2187960, 2190423, 2210020, 2210843, 2210844, 2210845, 2224519, 2225153
Bug Blocks:	2179001

Description Marian Rehak 2023-03-16 12:15:44 UTC

do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference).

Reference:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=49c47cc21b5b7a3d8deb18fc57b0aa2ab1286962

Comment 11 errata-xmlrpc 2023-06-21 14:38:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:3708 https://access.redhat.com/errata/RHSA-2023:3708

Comment 12 errata-xmlrpc 2023-06-21 14:39:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:3723 https://access.redhat.com/errata/RHSA-2023:3723

Comment 13 errata-xmlrpc 2023-06-27 14:57:51 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:3819 https://access.redhat.com/errata/RHSA-2023:3819

Comment 14 errata-xmlrpc 2023-06-27 14:58:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:3847 https://access.redhat.com/errata/RHSA-2023:3847

Comment 21 errata-xmlrpc 2023-08-29 08:43:57 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:4789 https://access.redhat.com/errata/RHSA-2023:4789

Comment 22 errata-xmlrpc 2023-08-29 09:20:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:4814 https://access.redhat.com/errata/RHSA-2023:4814

Comment 23 errata-xmlrpc 2023-08-29 09:20:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:4801 https://access.redhat.com/errata/RHSA-2023:4801