CVE-2023-0590: Use After Free
A use-after-free flaw was found in qdiscgraft in net/sched/schapi.c in the Linux Kernel due to a race problem leading to a denial-of-service problem.
Reference: https://lore.kernel.org/all/20221018203258.2793282-1-edumazet@google.com/
Crash: BUG: KASAN: use-after-free in tcfqdiscfind.part.0+0xa3a/0xac0 net/sched/clsapi.c:1066 Read of size 4 at addr ffff88802065e038 by task syz-executor.4/21027 CPU: 0 PID: 21027 Comm: syz-executor.4 Not tainted 6.0.0-rc3-syzkaller-00363-g7726d4c3e60b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Call Trace: <TASK> dumpstack lib/dumpstack.c:88 [inline] dumpstacklvl+0xcd/0x134 lib/dumpstack.c:106 printaddressdescription mm/kasan/report.c:317 [inline] printreport.cold+0x2ba/0x719 mm/kasan/report.c:433 kasanreport+0xb1/0x1e0 mm/kasan/report.c:495 tcfqdiscfind.part.0+0xa3a/0xac0 net/sched/clsapi.c:1066 tcfqdiscfind net/sched/clsapi.c:1051 [inline] tcnewtfilter+0x34f/0x2200 net/sched/clsapi.c:2018 rtnetlinkrcvmsg+0x955/0xca0 net/core/rtnetlink.c:6081 netlinkrcvskb+0x153/0x420 net/netlink/afnetlink.c:2501 netlinkunicastkernel net/netlink/afnetlink.c:1319 [inline] netlinkunicast+0x543/0x7f0 net/netlink/afnetlink.c:1345 netlinksendmsg+0x917/0xe10 net/netlink/afnetlink.c:1921 socksendmsgnosec net/socket.c:714 [inline] socksendmsg+0xcf/0x120 net/socket.c:734 syssendmsg+0x6eb/0x810 net/socket.c:2482 syssendmsg+0x110/0x1b0 net/socket.c:2536 syssendmsg+0xf3/0x1c0 net/socket.c:2565 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x35/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd RIP: 0033:0x7f5efaa89279
Other sources
A use-after-free flaw was found in qdiscgraft in net/sched/schapi.c in the Linux Kernel due to a race problem. This flaw leads to a denial of service issue. If patch ebda44da44f6 ("net: sched: fix race condition in qdiscgraft()") not applied yet, then kernel could be affected.
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a use-after-free flaw in qdiscgraft in net/sched/schapi.c. An attacker could exploit this vulnerability to gain elevated privileges.
— IBM
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2023-0590?
CVE-2023-0590 is classified as a critical severity vulnerability due to its potential to cause denial-of-service.
How do I fix CVE-2023-0590?
To fix CVE-2023-0590, upgrade to the recommended kernel versions provided by your distribution vendor, specifically those mentioned in the advisory.
What causes the CVE-2023-0590 vulnerability?
CVE-2023-0590 is caused by a use-after-free flaw in the Linux Kernel's qdisc_graft function due to a race condition.
Which Linux versions are affected by CVE-2023-0590?
CVE-2023-0590 affects certain versions of the Linux Kernel up to 6.1 and specific Red Hat kernel versions up to 5.14.0-284.11.1.
Is CVE-2023-0590 a remote vulnerability?
CVE-2023-0590 is not designated as a remote vulnerability, but it can lead to denial-of-service attacks locally.