CVE-2023-0461

一、漏洞信息
 漏洞编号：[CVE-2023-0461](https://nvd.nist.gov/vuln/detail/CVE-2023-0461)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.0,6.1.14,6.1.5,6.1.6,6.1.8
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c
 漏洞公开时间：2023-02-28 23:15:00
 漏洞创建时间：2023-02-23 03:44:48
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-0461
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| nvd | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2c02d41d71f90a5168391b6a5f2954112ba2307c |  |
| nvd | https://kernel.dance/#2c02d41d71f90a5168391b6a5f2954112ba2307c |  |
| redhat | https://access.redhat.com/security/cve/CVE-2023-0461 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-0461 | https://bugzilla.suse.com/show_bug.cgi?id=1208787 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-0461 | https://bugzilla.suse.com/show_bug.cgi?id=1208787 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2c02d41d71f90a5168391b6a5f2954112ba2307c | https://bugzilla.suse.com/show_bug.cgi?id=1208787 |
| suse_bugzilla | https://kernel.dance/#2c02d41d71f90a5168391b6a5f2954112ba2307c | https://bugzilla.suse.com/show_bug.cgi?id=1208787 |
| redhat_bugzilla | https://github.com/torvalds/linux/commit/2c02d41d71f90a5168391b6a5f2954112ba2307c | https://bugzilla.redhat.com/show_bug.cgi?id=2176192 |
| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2023-0461 | https://bugzilla.redhat.com/show_bug.cgi?id=2176192 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0461 | https://ubuntu.com/security/CVE-2023-0461 |
| ubuntu | https://ubuntu.com/security/notices/USN-5883-1 | https://ubuntu.com/security/CVE-2023-0461 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2023-0461 | https://ubuntu.com/security/CVE-2023-0461 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2023-0461 | https://ubuntu.com/security/CVE-2023-0461 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2023-0461 | https://ubuntu.com/security/CVE-2023-0461 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-0461 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2023-0461 |
| cve_search |  | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2c02d41d71f90a5168391b6a5f2954112ba2307c |
| cve_search |  | https://kernel.dance/#2c02d41d71f90a5168391b6a5f2954112ba2307c |
| nvd | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2c02d41d71f90a5168391b6a5f2954112ba2307c |  |
| nvd | https://kernel.dance/#2c02d41d71f90a5168391b6a5f2954112ba2307c |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2c02d41d71f90a5168391b6a5f2954112ba2307c |  | nvd |
|  |  | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2c02d41d71f90a5168391b6a5f2954112ba2307c |  | suse_bugzilla |
|  |  | https://github.com/torvalds/linux/commit/2c02d41d71f90a5168391b6a5f2954112ba2307c |  | redhat_bugzilla |
| linux_kernel | 4.14.303 | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=b689125d04949841337dfa730d48dd91ada9ce3a | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=734942cc4ea6478eed125af258da1bdbb4afe578 | linuxkernelcves |
| linux_kernel | 4.19.270 | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=755193f2523ce5157c2f844a4b6d16b95593f830 | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=734942cc4ea6478eed125af258da1bdbb4afe578 | linuxkernelcves |
| linux_kernel | 5.10.163 | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=f8ed0a93b5d576bbaf01639ad816473bdfd1dcb0 | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=734942cc4ea6478eed125af258da1bdbb4afe578 | linuxkernelcves |
| linux_kernel | 5.15.88 | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=dadd0dcaa67d27f550131de95c8e182643d2c9d6 | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=734942cc4ea6478eed125af258da1bdbb4afe578 | linuxkernelcves |
| linux_kernel | 5.4.229 | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=c6d29a5ffdbc362314853462a0e24e63330a654d | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=734942cc4ea6478eed125af258da1bdbb4afe578 | linuxkernelcves |
| linux_kernel | 6.0.19 | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=c1b5dee463cc1e89cfa655d6beff81ec1c0c4258 | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=734942cc4ea6478eed125af258da1bdbb4afe578 | linuxkernelcves |
| linux_kernel | 6.1.5 | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=7d242f4a0c8319821548c7176c09a6e0e71f223c | https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=734942cc4ea6478eed125af258da1bdbb4afe578 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c 
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS:受影响
2.openEuler-20.03-LTS-SP1(4.19.90):受影响
3.openEuler-20.03-LTS-SP3(4.19.90):受影响
4.openEuler-22.03-LTS-SP1:受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-22.03-LTS:否
2.openEuler-20.03-LTS-SP1(4.19.90):否
3.openEuler-20.03-LTS-SP3(4.19.90):否
4.openEuler-22.03-LTS-SP1:否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2023-1177

src-openEuler / kernel
Closed

Content Risk Flag

Comments (10)

src-openEuler / kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2023-0461

Comments (10)

Search

src-openEuler / kernel
Closed