cbcvebase.
CVE-2023-0461
published 2023-02-28

CVE-2023-0461: There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel…

PriorityP343high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.65%
47.1th percentile
There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c

Affected

27 ranges· showing 25
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.7-1 (bookworm)linux 6.1.7-1 (bookworm)
linuxlinux_kernel< 2c02d41d71f90a5168391b6a5f2954112ba2307c2c02d41d71f90a5168391b6a5f2954112ba2307c
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.178-15.10.178-1
linuxlinux_kernel>= 0 < 6.1.7-16.1.7-1
linuxlinux_kernel>= 0 < 6.1.7-16.1.7-1
linuxlinux_kernel>= 0 < 6.1.7-16.1.7-1
linuxlinux_kernel>= 0 < 4.15.0-206.2174.15.0-206.217
linuxlinux_kernel>= 0 < 5.4.0-144.1615.4.0-144.161
linuxlinux_kernel>= 0 < 5.15.0-67.745.15.0-67.74
linuxlinux_kernel>= 0 < 4.15.0-206.2174.15.0-206.217
linuxlinux_kernel>= 0 < 5.4.0-144.1615.4.0-144.161
linuxlinux_kernel>= 0 < 5.15.0-67.745.15.0-67.74
linuxlinux_kernel>= 4.13.0 < 4.14.3034.14.303
linuxlinux_kernel>= 4.19 < 4.19.2704.19.270
linuxlinux_kernel>= 5.10 < 5.10.1635.10.163
linuxlinux_kernel>= 5.15 < 5.15.885.15.88
linuxlinux_kernel>= 5.4 < 5.4.2295.4.229
linuxlinux_kernel>= 6.0 < 6.0.196.0.19
linuxlinux_kernel>= 6.1 < 6.1.56.1.5
msrccbl2_kernel_5.15.102.1-1_on_cbl_mariner_2.0
msrccbl_mariner_1.0_arm
msrccbl_mariner_1.0_x64
msrccbl_mariner_2.0_arm
msrccbl_mariner_2.0_x64

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian7.8HIGH
vendor_msrc7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.