High · published September 6, 2023
A use-after-free vulnerability in the Linux kernel's af_unix component can be exploited to achieve local privilege escalation.
The unix_stream_sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue. Thus there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.
We recommend upgrading past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c (or backported equivalents).
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 4.2, < 4.14.324 | 4.14.324 |
| linux/linux_kernel | ≥ 4.15, < 4.19.293 | 4.19.293 |
| linux/linux_kernel | ≥ 4.20, < 5.4.255 | 5.4.255 |
| linux/linux_kernel | ≥ 5.5, < 5.10.192 | 5.10.192 |
| linux/linux_kernel | ≥ 5.11, < 5.15.128 | 5.15.128 |
| linux/linux_kernel | ≥ 5.16, < 6.1.47 | 6.1.47 |
| linux/linux_kernel | ≥ 6.2, < 6.4.12 | 6.4.12 |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |