Bug 2189112 (CVE-2023-2006, ZDI-23-439, ZDI-CAN-15975)

Summary:	CVE-2023-2006 kernel: rxrpc: race condition between connection bundle lookup and removal
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	acaringi, allarkin, bhu, chwhite, crwood, dbohanno, ddepaula, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jaltman, jarod, jburrell, jdenham, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jpoimboe, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, kpatch-maint, ldoskova, lgoncalv, lleshchi, lzampier, mdionne, nmurray, ptalbert, qzhao, rhandlin, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.1-rc7	Doc Type:	If docs needed, set a value
Doc Text:	A race condition was found in the Linux kernel's RxRPC network protocol within the processing of RxRPC bundles. This issue results from improper locking when performing operations on an object. This flaw allows an attacker to escalate privileges and execute arbitrary code in the context of the kernel.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-04-27 18:10:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2170099, 2189115, 2189116, 2189117, 2189118, 2189119, 2189120, 2189121, 2189122, 2189123
Bug Blocks:	2186277

Description Mauro Matteo Cascella 2023-04-24 09:26:58 UTC

A race condition was found in the Linux kernel's RxRPC network protocol. Quoting ZDI security advisory [1]:

"This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the processing of RxRPC bundles. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel."

[1] https://www.zerodayinitiative.com/advisories/ZDI-23-439/

Comment 1 Mauro Matteo Cascella 2023-04-24 09:27:27 UTC

Upstream fix:
https://github.com/torvalds/linux/commit/3bcd6c7eaa53

Comment 5 Marc Dionne (Auristor) 2023-04-26 18:59:04 UTC

Note that although this bug is present in the RHEL 9.0 and 9.1 source trees, the rxrpc module for those releases is not built, shipped or supported by Red Hat or AuriStor.

For RHEL 9.2, the rxrpc module will be enabled (partner supported and shipped), but the fix for the CVE has already been applied (see https://bugzilla.redhat.com/show_bug.cgi?id=2170099 and the associated merge request).

So there should not be any RHEL releases that are vulnerable to the issue in this CVE.

Comment 6 Mauro Matteo Cascella 2023-04-27 13:14:25 UTC

Thanks Marc, I have updated the flaw bug's metadata accordingly.

Comment 7 Product Security DevOps Team 2023-04-27 18:10:35 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-2006