CVE-2023-0461

2023-02-2200:00:00

ubuntu.com

vulnerability

linux kernel

local privilege escalation

use-after-free

configuration flag

tls

xfrm_espintcp

inet_connection_sock

struct

tls context

tcp socket

setsockopt tcp_ulp

upgrade

commit

google kctf

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

5.1%

JSON

There is a use-after-free vulnerability in the Linux Kernel which can be
exploited to achieve local privilege escalation. To reach the vulnerability
kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be
configured, but the operation does not require any privilege. There is a
use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When
CONFIG_TLS is enabled, user can install a tls context (struct tls_context)
on a connected tcp socket. The context is not cleared if this socket is
disconnected and reused as a listener. If a new socket is created from the
listener, the context is inherited and vulnerable. The setsockopt TCP_ULP
operation does not require any privilege. We recommend upgrading past
commit 2c02d41d71f90a5168391b6a5f2954112ba2307c

Notes

Author	Note
sbeattie	reported by google kCTF, apparently.
rodrigo-zaiden	for some kernels, an extra commit was applied as a follow up commit: “UBUNTU: SAUCE: Fix inet_csk_listen_start after CVE-2023-0461” to properly address an error code variable during the backport. USN-5975-1 first publication included esm/xenial linux-gcp version 4.15.0-1146.162~16.04.1 by mistake, please refer to USN-6007-1.

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchlinux< 4.15.0-206.217UNKNOWN
ubuntu20.04noarchlinux< 5.4.0-144.161UNKNOWN
ubuntu22.04noarchlinux< 5.15.0-67.74UNKNOWN
ubuntu22.10noarchlinux< 5.19.0-35.36UNKNOWN
ubuntu18.04noarchlinux-aws< 4.15.0-1151.164UNKNOWN
ubuntu20.04noarchlinux-aws< 5.4.0-1097.105UNKNOWN
ubuntu22.04noarchlinux-aws< 5.15.0-1031.35UNKNOWN
ubuntu22.10noarchlinux-aws< 5.19.0-1020.21UNKNOWN
ubuntu20.04noarchlinux-aws-5.15< 5.15.0-1031.35~20.04.1UNKNOWN
ubuntu18.04noarchlinux-aws-5.4< 5.4.0-1097.105~18.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	linux	< 4.15.0-206.217	UNKNOWN
ubuntu	20.04	noarch	linux	< 5.4.0-144.161	UNKNOWN
ubuntu	22.04	noarch	linux	< 5.15.0-67.74	UNKNOWN
ubuntu	22.10	noarch	linux	< 5.19.0-35.36	UNKNOWN
ubuntu	18.04	noarch	linux-aws	< 4.15.0-1151.164	UNKNOWN
ubuntu	20.04	noarch	linux-aws	< 5.4.0-1097.105	UNKNOWN
ubuntu	22.04	noarch	linux-aws	< 5.15.0-1031.35	UNKNOWN
ubuntu	22.10	noarch	linux-aws	< 5.19.0-1020.21	UNKNOWN
ubuntu	20.04	noarch	linux-aws-5.15	< 5.15.0-1031.35~20.04.1	UNKNOWN
ubuntu	18.04	noarch	linux-aws-5.4	< 5.4.0-1097.105~18.04.1	UNKNOWN