Bug 2237760 (CVE-2023-4622)

Summary:	CVE-2023-4622 kernel: use after free in unix_stream_sendpage
Product:	[Other] Security Response	Reporter:	juneau
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	acaringi, allarkin, bhu, chwhite, cye, dbohanno, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, hmatsumo, jarod, jburrell, jdenham, jfaracco, jforbes, jlelli, joe.lawrence, jpoimboe, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, lzampier, nmurray, ptalbert, rkeshri, rogbas, rparrazo, rrobaina, rvrbovsk, rysulliv, scweaver, tglozar, tyberry, vkumar, walters, wcosta, williams, wmealing, ycote, ykopkova, zhijwang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	Kernel 6.4.12	Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free flaw was found in the Linux kernel's af_unix component that allows local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. This issue leads to a race condition where the unix_stream_sendpage() function could access a skb that is being released by garbage collection, resulting in a use-after-free issue.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2233137, 2233138, 2233139, 2233140, 2233141, 2233142, 2233143, 2233144, 2233145, 2233146, 2233147, 2233148, 2233150, 2233151, 2233153, 2233154, 2233156, 2233157, 2233163, 2237936, 2237937
Bug Blocks:	2230092, 2237762

Description juneau 2023-09-06 18:17:18 UTC

A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation.

The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.

We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-6.1.y&id=790c2f9d15b594350ae9bca7b236f2b1859de02c
https://kernel.dance/790c2f9d15b594350ae9bca7b236f2b1859de02c

Comment 1 Rohit Keshri 2023-09-07 19:37:03 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2237936]

Comment 2 Rohit Keshri 2023-09-07 19:37:15 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2237937]

Comment 7 Justin M. Forbes 2023-09-08 16:31:19 UTC

This was fixed for Fedora with the 6.4.12 stable kernel updates.

Comment 8 Alex 2023-10-12 15:07:07 UTC

*** Bug 2230094 has been marked as a duplicate of this bug. ***

Comment 46 errata-xmlrpc 2024-01-09 09:12:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:0089 https://access.redhat.com/errata/RHSA-2024:0089

Comment 47 errata-xmlrpc 2024-01-10 10:42:45 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:0113 https://access.redhat.com/errata/RHSA-2024:0113

Comment 48 errata-xmlrpc 2024-01-10 10:46:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:0134 https://access.redhat.com/errata/RHSA-2024:0134

Comment 50 errata-xmlrpc 2024-01-23 09:12:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:0340 https://access.redhat.com/errata/RHSA-2024:0340

Comment 51 errata-xmlrpc 2024-01-23 17:21:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions

Via RHSA-2024:0376 https://access.redhat.com/errata/RHSA-2024:0376

Comment 52 errata-xmlrpc 2024-01-23 17:28:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0378 https://access.redhat.com/errata/RHSA-2024:0378

Comment 53 errata-xmlrpc 2024-01-23 17:50:27 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:0381 https://access.redhat.com/errata/RHSA-2024:0381

Comment 54 errata-xmlrpc 2024-01-24 15:04:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2024:0402 https://access.redhat.com/errata/RHSA-2024:0402

Comment 55 errata-xmlrpc 2024-01-24 15:05:30 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Advanced Update Support
  Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.2 Telecommunications Update Service

Via RHSA-2024:0403 https://access.redhat.com/errata/RHSA-2024:0403

Comment 56 errata-xmlrpc 2024-01-24 16:29:02 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:0461 https://access.redhat.com/errata/RHSA-2024:0461

Comment 57 errata-xmlrpc 2024-01-24 16:36:24 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:0439 https://access.redhat.com/errata/RHSA-2024:0439

Comment 58 errata-xmlrpc 2024-01-24 16:38:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:0448 https://access.redhat.com/errata/RHSA-2024:0448

Comment 59 errata-xmlrpc 2024-01-24 16:45:07 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0412 https://access.redhat.com/errata/RHSA-2024:0412

Comment 60 errata-xmlrpc 2024-01-30 00:33:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:0554 https://access.redhat.com/errata/RHSA-2024:0554

Comment 61 errata-xmlrpc 2024-01-30 12:27:08 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:0563 https://access.redhat.com/errata/RHSA-2024:0563

Comment 62 errata-xmlrpc 2024-01-30 12:27:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.4 Telecommunications Update Service

Via RHSA-2024:0562 https://access.redhat.com/errata/RHSA-2024:0562

Comment 63 errata-xmlrpc 2024-01-30 13:10:19 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions

Via RHSA-2024:0593 https://access.redhat.com/errata/RHSA-2024:0593

Comment 64 errata-xmlrpc 2024-01-30 13:22:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:0575 https://access.redhat.com/errata/RHSA-2024:0575

Comment 66 errata-xmlrpc 2024-03-12 00:44:25 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:1250 https://access.redhat.com/errata/RHSA-2024:1250

Comment 67 errata-xmlrpc 2024-03-12 01:01:00 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:1253 https://access.redhat.com/errata/RHSA-2024:1253

Comment 68 errata-xmlrpc 2024-03-13 09:08:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2024:1306 https://access.redhat.com/errata/RHSA-2024:1306

Comment 71 errata-xmlrpc 2024-04-23 00:42:12 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2024:1960 https://access.redhat.com/errata/RHSA-2024:1960

Comment 72 errata-xmlrpc 2024-04-23 15:43:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2024:2003 https://access.redhat.com/errata/RHSA-2024:2003

Comment 73 errata-xmlrpc 2024-04-23 16:39:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2024:2004 https://access.redhat.com/errata/RHSA-2024:2004

Comment 80 errata-xmlrpc 2024-08-13 00:29:01 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.7 Advanced Update Support

Via RHSA-2024:5261 https://access.redhat.com/errata/RHSA-2024:5261