CVE-2023-0461

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-0461
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-0461.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-0461
Downstream
AZL (1)
CLSA (3)
DEBIAN (1)
OESA (4)
RHSA (18)
SUSE (29)
UBUNTU (1)
Related
ALSA (4)
SUSE (29)
Published
2023-02-28T14:23:02Z
Modified
2026-10-15T02:49:00Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Use-after-free vulnerability in the Linux Kernel
Details

There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.

There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.

When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable.

The setsockopt TCP_ULP operation does not require any privilege.

We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c

Database specific 
{
    "cna_assigner":  "Google",
    "cwe_ids":  [
        "CWE-416"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/0xxx/CVE-2023-0461.json"
}
References

Affected packages

Git / git.kernel.org

Affected ranges

Type
GIT
Repo
https://git.kernel.org
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2c02d41d71f90a5168391b6a5f2954112ba2307c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "2c02d41d71f90a5168391b6a5f2954112ba2307c"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-0461.json"