Junglewise Threat Intelligence

CVE-2023-6932: Linux Kernel use-after-free in ipv4: igmp

CVE-2023-6932 · Severity: high · CVSS 7.8 · Published 2023-12-19

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A security vulnerability exists in the Linux kernel's networking component responsible for managing multicast group memberships (IGMP). A local user on a system could exploit a timing flaw to gain administrative (root) privileges or cause the system to crash. This issue primarily affects servers and workstations where multiple users have local access or where untrusted applications are running.

Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel's ipv4:igmp component due to a race condition. When an IGMPv2 Query message is received, the kernel may start a timer on an object that is simultaneously being freed by another thread (e.g., during a device 'down' or multicast leave operation). Specifically, the race allows a timer to be registered on an RCU read-locked object after its reference count has reached zero. A local attacker can exploit this to execute arbitrary code in kernel context, leading to local privilege escalation (LPE). The issue is fixed by using 'refcount_inc_not_zero' to ensure the object is still valid before modifying its timer.

Affected products

  • Linux Linux Kernel 2.6.12 up to 6.7 (excluding 4.14.332, 4.19.301, 5.4.263, 5.10.203, 5.15.142, 6.1.66, 6.6.5)

Timeline

  • 2023-11-24: patched: Fix committed to mainline Linux kernel (commit e2b706c)
  • 2023-12-19: disclosed: CVE-2023-6932 published

References

Related threats