Bug 2176192 (CVE-2023-0461) - CVE-2023-0461 kernel: net/ulp: use-after-free in listening ULP sockets
Summary: CVE-2023-0461 kernel: net/ulp: use-after-free in listening ULP sockets
Keywords:
Status: NEW
Alias: CVE-2023-0461
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Red Hat2176941 Red Hat2176945 Red Hat2176950 Red Hat2176956 Red Hat2176958 Red Hat2176963 Red Hat2176965 Red Hat2176969 Engineering2178010 Red Hat2162758 2176815 Red Hat2176942 Red Hat2176943 Red Hat2176944 Red Hat2176946 Red Hat2176947 Red Hat2176948 Red Hat2176949 Red Hat2176952 Red Hat2176953 Red Hat2176954 Red Hat2176955 Red Hat2176957 Red Hat2176959 Red Hat2176960 Red Hat2176961 Red Hat2176962 Red Hat2176964 Red Hat2176966 Red Hat2176967 Red Hat2176968 Red Hat2176970 Red Hat2186424
Blocks: Embargoed2176193 Red Hat2176801
TreeView+ depends on / blocked
 
Reported: 2023-03-07 15:49 UTC by Mauro Matteo Cascella
Modified: 2023-05-17 15:23 UTC (History)
50 users (show)

Fixed In Version: kernel 6.2-rc3
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free flaw was found in the Linux kernel’s TLS protocol functionality in how a user installs a tls context (struct tls_context) on a connected TCP socket. This flaw allows a local user to crash or potentially escalate their privileges on the system.
Clone Of:
Environment:
Last Closed: 2023-03-09 15:24:48 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2023:1556 0 None None None 2023-04-04 06:52:19 UTC
Red Hat Product Errata RHSA-2023:1557 0 None None None 2023-04-04 06:55:25 UTC
Red Hat Product Errata RHSA-2023:1662 0 None None None 2023-04-05 13:43:01 UTC
Red Hat Product Errata RHSA-2023:1841 0 None None None 2023-04-18 16:34:31 UTC
Red Hat Product Errata RHSA-2023:1923 0 None None None 2023-04-21 08:17:48 UTC
Red Hat Product Errata RHSA-2023:2148 0 None None None 2023-05-09 07:13:00 UTC
Red Hat Product Errata RHSA-2023:2458 0 None None None 2023-05-09 07:51:30 UTC
Red Hat Product Errata RHSA-2023:2736 0 None None None 2023-05-16 08:06:19 UTC
Red Hat Product Errata RHSA-2023:2951 0 None None None 2023-05-16 08:35:05 UTC
Red Hat Product Errata RHSA-2023:3190 0 None None None 2023-05-17 15:23:50 UTC
Red Hat Product Errata RHSA-2023:3191 0 None None None 2023-05-17 15:23:59 UTC

Description Mauro Matteo Cascella 2023-03-07 15:49:23 UTC 
NVD description: There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege.

Upstream commit:
https://github.com/torvalds/linux/commit/2c02d41d71f90a5168391b6a5f2954112ba2307c
Comment 2 Alex 2023-03-09 11:40:13 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2176815]
Comment 4 Product Security DevOps Team 2023-03-09 15:24:44 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2023-0461
Comment 39 Justin M. Forbes 2023-03-14 18:43:15 UTC 
This was fixed for Fedora with the 6.1.5 stable kernel updates.
Comment 42 errata-xmlrpc 2023-04-04 06:52:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:1556 https://access.redhat.com/errata/RHSA-2023:1556
Comment 43 errata-xmlrpc 2023-04-04 06:55:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:1557 https://access.redhat.com/errata/RHSA-2023:1557
Comment 44 errata-xmlrpc 2023-04-05 13:42:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2023:1662 https://access.redhat.com/errata/RHSA-2023:1662
Comment 51 errata-xmlrpc 2023-04-18 16:34:29 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:1841 https://access.redhat.com/errata/RHSA-2023:1841
Comment 52 errata-xmlrpc 2023-04-21 08:17:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2023:1923 https://access.redhat.com/errata/RHSA-2023:1923
Comment 55 errata-xmlrpc 2023-05-09 07:12:56 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2148 https://access.redhat.com/errata/RHSA-2023:2148
Comment 56 errata-xmlrpc 2023-05-09 07:51:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2458 https://access.redhat.com/errata/RHSA-2023:2458
Comment 57 errata-xmlrpc 2023-05-16 08:06:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2736 https://access.redhat.com/errata/RHSA-2023:2736
Comment 58 errata-xmlrpc 2023-05-16 08:35:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:2951 https://access.redhat.com/errata/RHSA-2023:2951
Comment 59 errata-xmlrpc 2023-05-17 15:23:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2023:3190 https://access.redhat.com/errata/RHSA-2023:3190
Comment 60 errata-xmlrpc 2023-05-17 15:23:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2023:3191 https://access.redhat.com/errata/RHSA-2023:3191
Note You need to log in before you can comment on or make changes to this bug.