Bug 2179000 (CVE-2023-28466) - CVE-2023-28466 kernel: tls: race condition in do_tls_getsockopt may lead to use-after-free or NULL pointer dereference
Summary: CVE-2023-28466 kernel: tls: race condition in do_tls_getsockopt may lead to u...
Keywords:
Status: NEW
Alias: CVE-2023-28466
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2179814 2179815 2179816 2179817 2179818 2179819 2179820 2179821 2179822 2179823 2179824 2179825 2184152 2184153 2187959 2187960 2190423 2210020 2210843 2210844 2210845 2224519 2225153
Blocks: 2179001
TreeView+ depends on / blocked
 
Reported: 2023-03-16 12:15 UTC by Marian Rehak
Modified: 2023-11-02 12:29 UTC (History)
39 users (show)

Fixed In Version: kernel 6.3-rc2
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free flaw was found in the do_tls_getsockopt function in net/tls/tls_main.c in the Transport Layer Security (TLS) in the Network subcompact in the Linux kernel. This flaw allows an attacker to cause a NULL pointer dereference problem due to a race condition.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:3708 0 None None None 2023-06-21 14:38:26 UTC
Red Hat Product Errata RHSA-2023:3723 0 None None None 2023-06-21 14:39:11 UTC
Red Hat Product Errata RHSA-2023:3819 0 None None None 2023-06-27 14:57:56 UTC
Red Hat Product Errata RHSA-2023:3847 0 None None None 2023-06-27 14:58:04 UTC
Red Hat Product Errata RHSA-2023:4789 0 None None None 2023-08-29 08:43:59 UTC
Red Hat Product Errata RHSA-2023:4801 0 None None None 2023-08-29 09:20:52 UTC
Red Hat Product Errata RHSA-2023:4814 0 None None None 2023-08-29 09:20:08 UTC

Description Marian Rehak 2023-03-16 12:15:44 UTC 
do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference).

Reference:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=49c47cc21b5b7a3d8deb18fc57b0aa2ab1286962
Comment 11 errata-xmlrpc 2023-06-21 14:38:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:3708 https://access.redhat.com/errata/RHSA-2023:3708
Comment 12 errata-xmlrpc 2023-06-21 14:39:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:3723 https://access.redhat.com/errata/RHSA-2023:3723
Comment 13 errata-xmlrpc 2023-06-27 14:57:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:3819 https://access.redhat.com/errata/RHSA-2023:3819
Comment 14 errata-xmlrpc 2023-06-27 14:58:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:3847 https://access.redhat.com/errata/RHSA-2023:3847
Comment 21 errata-xmlrpc 2023-08-29 08:43:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:4789 https://access.redhat.com/errata/RHSA-2023:4789
Comment 22 errata-xmlrpc 2023-08-29 09:20:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:4814 https://access.redhat.com/errata/RHSA-2023:4814
Comment 23 errata-xmlrpc 2023-08-29 09:20:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Extended Update Support

Via RHSA-2023:4801 https://access.redhat.com/errata/RHSA-2023:4801
Note You need to log in before you can comment on or make changes to this bug.