PT-2023-2332 · Linux+9 · Linux Kernel+9
Hangyu Hua
·
Published
2023-02-28
·
Updated
2024-04-15
·
CVE-2023-28466
CVSS v3.1
7.0
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.2.7
Description
The issue is related to a race condition in the Linux kernel's TLS protocol implementation, specifically in the
do tls getsockopt conf() and do tls setsockopt conf() functions in the net/tls/tls main.c module. This is due to the lack of synchronization in do tls getsockopt conf(), allowing for concurrent access to ctx->crypto send.info. Exploitation of this issue can lead to a denial of service. The do tls getsockopt function lacks a lock sock call, resulting in a race condition that can cause a use-after-free or NULL pointer dereference.Recommendations
For Linux kernel versions prior to 6.2.7, update to version 6.2.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the
net/tls/tls main.c module to minimize the risk of exploitation. Avoid using the do tls getsockopt function in the affected API endpoint until the issue is resolved.Fix
Use After Free
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Linux Kernel
Red Hat
Rocky Linux
Suse
Ubuntu