CVE-2023-4622: Use-after-free in Linux kernel's af_unix component
A use-after-free vulnerability in the Linux kernel's afunix component can be exploited to achieve local privilege escalation.
The unixstreamsendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unixstreamsendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.
We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.
Other sources
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a use-after-free flaw in the afunix component. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-4622?
CVE-2023-4622 is a use-after-free vulnerability in the Linux kernel's af_unix component that can be exploited to achieve local privilege escalation.
What is the severity of CVE-2023-4622?
The severity of CVE-2023-4622 is high (7.8).
How can CVE-2023-4622 be exploited?
CVE-2023-4622 can be exploited by using the unix_stream_sendpage() function to add data to the last skb in the peer's recv queue without locking the queue, creating a race condition.
Which software is affected by CVE-2023-4622?
The Linux kernel versions up to and including 6.4.15 and Debian Linux version 12.0 are affected by CVE-2023-4622.
How can I fix CVE-2023-4622?
To fix CVE-2023-4622, update the Linux kernel to versions 6.1.52-1 or higher and Debian Linux to version 6.5.3-1 or higher.