CVE-2023-0461 Use-after-free vulnerability in the Linux Kernel

High 7.8 Published 28 Feb 2023 Updated 13 Feb 2025

A use-after-free in the Linux Kernel allows local privilege escalation when TLS or ESPINTCP is enabled, requiring a kernel patch.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2023-0461?

CVE-2023-0461 is a high-severity use after free vulnerability in Linux kernel, published on 28 Feb 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.

There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.

When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable.

The setsockopt TCP_ULP operation does not require any privilege.

We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c

Weakness: CWE-416

Which versions are affected by CVE-2023-0461?

It affects 1 product.

Linux distribution packages (40)

`bpftool` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`bpftool-debuginfo` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-abi-stablelists` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-core` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-debug` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-debug-core` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-debug-debuginfo` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-debug-devel` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-debug-modules` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-debug-modules-extra` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-debuginfo` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-debuginfo-common-aarch64` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-debuginfo-common-ppc64le` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-debuginfo-common-s390x` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-debuginfo-common-x86_64` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-devel` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-doc` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-modules` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-modules-extra` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-tools` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-tools-debuginfo` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-tools-libs` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-zfcpdump` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-zfcpdump-core` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-zfcpdump-debuginfo` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-zfcpdump-devel` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-zfcpdump-modules` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kernel-zfcpdump-modules-extra` Red Hat:rhel_eus:8.6::baseos	All versions	`0:4.18.0-372.52.1.el8_6`
`kpatch-patch-4_18_0-372_32_1` Red Hat:rhel_eus:8.6::baseos	All versions	`0:1-6.el8_6`
`kpatch-patch-4_18_0-372_32_1-debuginfo` Red Hat:rhel_eus:8.6::baseos	All versions	`0:1-6.el8_6`
`kpatch-patch-4_18_0-372_32_1-debugsource` Red Hat:rhel_eus:8.6::baseos	All versions	`0:1-6.el8_6`
`kpatch-patch-4_18_0-372_36_1` Red Hat:rhel_eus:8.6::baseos	All versions	`0:1-5.el8_6`
`kpatch-patch-4_18_0-372_36_1-debuginfo` Red Hat:rhel_eus:8.6::baseos	All versions	`0:1-5.el8_6`
`kpatch-patch-4_18_0-372_36_1-debugsource` Red Hat:rhel_eus:8.6::baseos	All versions	`0:1-5.el8_6`
`kpatch-patch-4_18_0-372_40_1` Red Hat:rhel_eus:8.6::baseos	All versions	`0:1-5.el8_6`
`kpatch-patch-4_18_0-372_40_1-debuginfo` Red Hat:rhel_eus:8.6::baseos	All versions	`0:1-5.el8_6`
`kpatch-patch-4_18_0-372_40_1-debugsource` Red Hat:rhel_eus:8.6::baseos	All versions	`0:1-5.el8_6`
`kpatch-patch-4_18_0-372_41_1` Red Hat:rhel_eus:8.6::baseos	All versions	`0:1-4.el8_6`
`kpatch-patch-4_18_0-372_41_1-debuginfo` Red Hat:rhel_eus:8.6::baseos	All versions	`0:1-4.el8_6`

Products include Linux kernel.

How do I fix CVE-2023-0461?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2023-0461 being exploited?

There is no known exploitation of CVE-2023-0461 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Linux kernel vulnerabilities

Sources

Also known as AZL-25353, DEBIAN-CVE-2023-0461, GHSA-222x-4qhm-7h5f, RHSA-2023:1841, RHSA-2023:1923, UBUNTU-CVE-2023-0461.