Use-after-free in Linux kernel - CVE-2023-3269

Vulnerability identifier: #VU78002

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-3269

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: Public exploit is available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error in the handling of stack expansion within the memory management subsystem in the Linux kernel. A local user can trigger a use-after-free error and execute arbitrary code on the system with elevated privileges.

Linux kernel
Debian Linux
Amazon Linux AMI
Ubuntu
Fedora
linux-image-oem-22.04c (Ubuntu package)
linux-image-6.1.0-1017-oem (Ubuntu package)
kernel
linux (Debian package)
linux-image-6.2.0-26-generic-64k (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-generic-64k (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-6.2.0-26-generic (Ubuntu package)
linux-image-6.2.0-26-generic-lpae (Ubuntu package)
linux-image-ibm (Ubuntu package)
linux-image-6.2.0-1006-ibm (Ubuntu package)
linux-image-6.2.0-1008-azure (Ubuntu package)
linux-image-6.2.0-1008-oracle (Ubuntu package)
linux-image-6.2.0-1008-aws (Ubuntu package)
linux-image-azure (Ubuntu package)
linux-image-oracle (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-6.2.0-1009-lowlatency-64k (Ubuntu package)
linux-image-lowlatency-64k (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-6.2.0-1009-kvm (Ubuntu package)
linux-image-6.2.0-1009-lowlatency (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-6.2.0-1009-raspi (Ubuntu package)
linux-image-raspi-nolpae (Ubuntu package)
linux-image-raspi (Ubuntu package)
linux-image-gcp (Ubuntu package)
linux-image-6.2.0-1010-gcp (Ubuntu package)

Install updates from vendor's website.

linux-image-oem-22.04c (Ubuntu package) - update to 6.1.0.1017.17
linux-image-6.1.0-1017-oem (Ubuntu package) - update to 6.1.0-1017.17
kernel - update to 6.1.34-59.116
linux (Debian package) - update to 6.1.37-1
linux-image-6.2.0-26-generic-64k (Ubuntu package) - update to 6.2.0-26.26
linux-image-virtual (Ubuntu package) - update to 6.2.0.26.26
linux-image-generic-64k (Ubuntu package) - update to 6.2.0.26.26
linux-image-generic (Ubuntu package) - update to 6.2.0.26.26
linux-image-generic-lpae (Ubuntu package) - update to 6.2.0.26.26
linux-image-6.2.0-26-generic (Ubuntu package) - update to 6.2.0-26.26
linux-image-6.2.0-26-generic-lpae (Ubuntu package) - update to 6.2.0-26.26
linux-image-ibm (Ubuntu package) - update to 6.2.0.1006.6
linux-image-6.2.0-1006-ibm (Ubuntu package) - update to 6.2.0-1006.6
linux-image-6.2.0-1008-azure (Ubuntu package) - update to 6.2.0-1008.8
linux-image-6.2.0-1008-oracle (Ubuntu package) - update to 6.2.0-1008.8
linux-image-6.2.0-1008-aws (Ubuntu package) - update to 6.2.0-1008.8
linux-image-azure (Ubuntu package) - update to 6.2.0.1008.8
linux-image-oracle (Ubuntu package) - update to 6.2.0.1008.8
linux-image-aws (Ubuntu package) - update to 6.2.0.1008.9
linux-image-6.2.0-1009-lowlatency-64k (Ubuntu package) - update to 6.2.0-1009.9
linux-image-lowlatency-64k (Ubuntu package) - update to 6.2.0.1009.9
linux-image-kvm (Ubuntu package) - update to 6.2.0.1009.9
linux-image-6.2.0-1009-kvm (Ubuntu package) - update to 6.2.0-1009.9
linux-image-6.2.0-1009-lowlatency (Ubuntu package) - update to 6.2.0-1009.9
linux-image-lowlatency (Ubuntu package) - update to 6.2.0.1009.9
linux-image-6.2.0-1009-raspi (Ubuntu package) - update to 6.2.0-1009.11
linux-image-raspi-nolpae (Ubuntu package) - update to 6.2.0.1009.12
linux-image-raspi (Ubuntu package) - update to 6.2.0.1009.12
linux-image-gcp (Ubuntu package) - update to 6.2.0.1010.10
linux-image-6.2.0-1010-gcp (Ubuntu package) - update to 6.2.0-1010.10
kernel - addressed in versions 6.3.11-100.fc37, 6.3.11-200.fc38, 6.3.12-100.fc37

• Exploit #9635 - StackRot (CVE-2023-3269: Linux kernel privilege escalation vulnerability) (March 22, 2024)

• https://seclists.org/oss-sec/2023/q3/4
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9471f1f2f50282b9e8f59198ec6bb738b4ccc009

• Privilege escalation in Linux kernel
• Debian update for linux
• Ubuntu update for linux-oem-6.1
• Ubuntu update for linux
• Fedora 37 update for kernel
• Fedora 38 update for kernel
• Fedora 37 update for kernel
• Amazon Linux AMI update for kernel