Several Distros Release Important Advisories for Actively Exploited Linux Kernel Use After Free Vuln

Several high-impact security vulnerabilities were recently discovered and fixed in the Linux kernel. These flaws could result in memory exhaustion, system crashes, denial of service (DoS), the exposure of sensitive information, cross-site scripting (XSS) attacks, privilege escalation attacks, or the execution of arbitrary code.

The Cybersecurity and Infrastructure Security Agency (CISA) has added one of these bugs, a use after free vulnerability in the ALSA PCM package in the kernel (CVE-2023-0266), to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. It is critical that all impacted users apply the Linux kernel updates issued by their distro(s) now to protect the confidentiality, integrity and availability of their systems and their sensitive data. This article will cover the vulnerabilities recently found in the kernel, their potential security impact, and how users can protect against these issues and other vulnerabilities that threaten the security of their systems. 

The Discovery & The Impact 

Vulnerabilities recently discovered and patched in the kernel include:

• A use-after-free vulnerability existed in the Advanced Linux Sound Architecture (ALSA) subsystem. A local attacker could use this to cause a denial of service (system crash). There is evidence of active exploitation of this bug, according to the CISA. (CVE-2023-0266)
• The System V IPC implementation in the Linux kernel did not properly handle large shared memory counts. A local attacker could use this to cause a denial of service (memory exhaustion). (CVE-2021-3669)
• A use-after-free vulnerability existed in the SGI GRU driver in the Linux kernel. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-3424)
• The VMware Virtual GPU DRM driver in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-36280)
• The DVB Core driver in the Linux kernel did not properly perform reference counting in some situations, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-41218)
• The network queuing discipline implementation in the Linux kernel contained a null pointer dereference in some situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2022-47929)
• The prctl syscall implementation in the Linux kernel did not properly protect against indirect branch prediction attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-0045)
• The IPv6 implementation in the Linux kernel contained a NULL pointer dereference vulnerability in certain situations. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-0394)
• The ATM VC queuing discipline implementation in the Linux kernel contained a type confusion vulnerability in some situations. An attacker could use this to cause a denial of service (system crash). (CVE-2023-23455)
• The RNDIS USB driver in the Linux kernel contained an integer overflow vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)
• The DVB USB AZ6027 driver in the Linux kernel contained a null pointer dereference when handling certain messages from user space. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-28328)
• The KVM VMX implementation in the kernel did not properly handle indirect branch prediction isolation between L1 and L2 VMs, allowing for speculative execution attacks. (CVE-2022-2196)

Many of the vulnerabilities have been rated by the National Vulnerability Database as having an important or high severity, and have a high confidentiality, integrity and availability impact.

How To Secure Your System Against Dangerous Vulnerabilities Like These

Distros have released important updates for the kernel that mitigate these bugs. All impacted users should update immediately to protect against attacks leading to downtime and compromise. Linux security expert and LinuxSecurity.com Founder Dave Wreski warns, “Threat actors frequently exploit unpatched security vulnerabilities to gain access to corporate networks, enable malicious code, and compromise critical systems. It is crucial that all admins and organizations track security advisories diligently and apply patches as soon as they are released.”

To stay on top of important updates released by the open-source programs and applications you use, be sure to register as a LinuxSecurity user, then subscribe to our Linux Advisory Watch newsletter and customize your advisories for the distro(s) you use. This will enable you to stay up-to-date on the latest, most significant issues impacting the security of your systems.

Follow @LS_Advisories on Twitter for real-time updates on advisories for your distro(s).