Critical Use-After-Free Vulnerability in Linux Kernel's MPTCP Listener - CVE-2023-53088
Summary
CVE-2023-53088: In the Linux kernel, the following vulnerability has been resolved: mptcp: fix UaF in listener shutdown As reported by Christoph after having refactored the passive socket initialization, the mptcp listener shutdown path... Affects linux versions < 6.1.25-1. Fixed in 6.1.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core of many operating systems, providing essential services for hardware and software interaction. It supports various functionalities, including process management, memory management, and device control. The kernel's Multipath TCP (MPTCP) feature allows for the use of multiple network paths for a single TCP connection, enhancing performance and reliability. However, the recent vulnerability identified as CVE-2023-53088 exposes the MPTCP listener to a use-after-free (UaF) issue during shutdown, potentially leading to system instability or exploitation.
Vulnerability Detail
CVE-2023-53088 is a use-after-free vulnerability in the MPTCP listener shutdown path of the Linux kernel. It was reported after a refactor of the passive socket initialization, which inadvertently introduced the UaF issue. The vulnerability arises when the kernel attempts to access a socket that has already been freed, leading to potential memory corruption and arbitrary code execution. The specific error occurs in the _raw_spin_lock_bh function, where a write operation is attempted on a freed memory address, as indicated by KASAN reports. This vulnerability can be exploited by an attacker to cause a denial of service or execute arbitrary code in the context of the kernel.
How To Fix
Minimum fixed version
6.1.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
CVE-2023-53088 is a critical vulnerability in the Linux kernel's MPTCP listener that poses significant risks to system stability and security. Users are strongly advised to update their kernel to the patched version 6.1.25-1 to mitigate these risks. Regular monitoring and updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2023-53088 is a use-after-free vulnerability in the Linux kernel's MPTCP listener, which can lead to memory corruption and potential exploitation.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading a manifest file like package-lock.json, Vulert can alert you in real-time about vulnerabilities.
Exploitation of this vulnerability could lead to system instability, denial of service, or arbitrary code execution in the kernel context.
You can update your Linux kernel by running the command: sudo apt-get update && sudo apt-get install linux=6.1.25-1 in your terminal.
Currently, there are no specific workarounds available. The recommended action is to apply the patch by updating to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
