CVE-2023-0461
Assigner: Google
Published: 2023-02-28T14:23:02.224Z
State: PUBLISHED
affected: defaultStatus: unaffected
packageName: kernel
product: Linux Kernel
repo: https://git.kernel.org
vendor: Linux
versions: lessThan: 2c02d41d71f90a5168391b6a5f2954112ba2307c
status: affected
version: 0
versionType: git
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: slipper
datePublic: 2023-01-02T23:00:00.000Z
descriptions: supportingMedia: base64: no
type: text/html
value: <p>There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag <code>CONFIG_TLS</code>&nbsp;or <code>CONFIG_XFRM_ESPINTCP</code>&nbsp;has to be configured, but the operation does not require any privilege.</p><p>There is a use-after-free bug of <code>icsk_ulp_data</code>&nbsp;of a <code>struct inet_connection_sock</code>.</p><p>When <code>CONFIG_TLS</code>&nbsp;is enabled, user can install a tls context (<code>struct tls_context</code>) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable.</p><p>The <code>setsockopt</code>&nbsp;<code>TCP_ULP</code>&nbsp;operation does not require any privilege.</p>We recommend upgrading past commit&nbsp;2c02d41d71f90a5168391b6a5f2954112ba2307c
value: There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.

There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.

When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable.

The setsockopt TCP_ULP operation does not require any privilege.

We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c
impacts: capecId: CAPEC-233
descriptions: value: CAPEC-233 Privilege Escalation
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-416
description: CWE-416 Use After Free
type: CWE
source: discovery: EXTERNAL
title: Use-after-free vulnerability in the Linux Kernel 
x_generator: engine: Vulnogram 0.1.0-dev