CVE-2023-1829: (Pwn2Own) Canonical Ubuntu tcindex Double-Free Local Privilege Escalation Vulnerability
A use-after-free vulnerability in the Linux Kernel traffic control index filter (tcindex) can be exploited to achieve local privilege escalation. The tcindexdelete function which does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure which can later lead to double freeing the structure. A local attacker user can use this vulnerability to elevate its privileges to root. We recommend upgrading past commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28.
Other sources
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a use-after-free flaw when deleting a perfect hash filter in the tcindexdelete() function. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges.
— IBM
This vulnerability allows local attackers to escalate privileges on affected installations of Canonical Ubuntu. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the tcindex module. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the kernel.
— ZDI
Affected Software
Remediation
Mitigation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1829?
CVE-2023-1829 is considered a high-severity vulnerability that can lead to local privilege escalation in affected systems.
How do I fix CVE-2023-1829?
To remediate CVE-2023-1829, update your Linux kernel or IBM Security Verify Governance, Identity Manager components to the patched versions provided by the vendor.
Which Linux kernel versions are affected by CVE-2023-1829?
CVE-2023-1829 affects Linux kernel versions prior to 4.14.308 and versions between 4.15 and up to 6.2.5.
What products are affected by CVE-2023-1829?
CVE-2023-1829 impacts IBM Security Verify Governance components and multiple versions of the Linux kernel.
Can CVE-2023-1829 be exploited remotely?
CVE-2023-1829 is a local privilege escalation vulnerability, which means it requires local access to the affected system for exploitation.