CVE-2023-4622

Se puede explotar una vulnerabilidad de use-after-free en el componente Linux kernel's af_unix para lograr una escalada de privilegios local. La función unix_stream_sendpage() intenta añadir datos al último skb en la cola peer's recv sin bloquear la cola. Por lo tanto, existe una carrera donde unix_stream_sendpage() podría acceder a un skb sin bloqueo que está siendo liberado mediante la recolección de basura, resultando en use-after-free. Recomendamos actualizar después del commit 790c2f9d15b594350ae9bca7b236f2b1859de02c.

A use-after-free flaw was found in the Linux kernel's af_unix component that allows local privilege escalation. The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. This issue leads to a race condition where the unix_stream_sendpage() function could access a skb that is being released by garbage collection, resulting in a use-after-free issue.

This update for the Linux Kernel 5.14.21-150400_24_81 fixes several issues. The following security issues were fixed. Fixed use-after-free vulnerability in nf_tables can be exploited to achieve local privilege escalation. Fixed a use-after-free vulnerability in netfilter: nf_tables component can be exploited to achieve local privilege escalation. Fixed an use-after-free vulnerability in the fs/smb/client component which could be exploited to achieve local privilege escalation. Fixed a use-after-free vulnerability in the Unix domain sockets component which could be exploited to achieve local privilege escalation. Fixed an incorrect verifier pruning in BPF that could lead to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape.