Linux Kernel: Use-After-Free Risk Newly Discovered and High Severity

May 05, 2023 •

2 - 4 min read

Threat actors frequently exploit unpatched security vulnerabilities in software and applications to infect Linux systems with harmful malware, but what happens when we implement a comprehensive, automated patch management solution to identify and remediate security issues before they are exploited by adversaries? We put this approach to the test, and it proved to be highly effective in stopping Linux malware attacks.

WordPress has had a questionable security history, but what happens when we add on predictive analysis detection and automated remediation to find and fix new and known vulnerabilities? We put a few strategies to the test to find the best way to secure your WordPress install, and this one emerged as highly effective.

Attackers are exploiting a use-after-free vulnerability recently discovered and fixed in the Linux kernel to elevate their privileges to root, potentially resulting in unauthorized access, data theft, malware installation, or system damage. With a low attack complexity and a high confidentiality, integrity and availability impact, it is critical that all impacted users update immediately to protect against this dangerous bug.

Continue reading to learn about other significant issues that have been discovered and fixed in the open-source programs and applications you use.

Yours in Open Source,

Brittany Signature 150 Esm W150

Linux Kernel

The Discovery

A use-after-free vulnerability (CVE-2023-1829) was discovered in the Linux Kernel traffic control index filter (tcindex). The tcindex_delete function does not properly deactivate filters in case of a perfect hashes while deleting the underlying structure, which can later lead to double freeing the structure.

The Impact

A local attacker can use this vulnerability to elevate their privileges to root, potentially resulting in unauthorized access, data theft, malware installation, or system damage.

The Fix

With a low attack complexity and a high confidentiality, integrity and availability impact, it is critical that all impacted users apply the kernel updates issued but their distro(s) as soon as possible to protect against the compromise of sensitive data and damaging malware infections.

Your Related Advisories:

[distro_list_1]

Git

The Discovery

Multiple important security issues have been found in the Git distributed revision control system. These bugs have been classified as “high-severity” by the National Vulnerability Database (NVD) due to their high confidentiality, integrity and availability impact, and the low attack complexity and lack of privileges required to exploit them.

The Impact

These vulnerabilities could lead to a path outside of the Git working tree potentially being overwritten with partially controlled contents, the possibility of malicious placement of crafted messages when Git is built without translated messages, and arbitrary configuration injection.

The Fix

Git 2.40.1 has been released to address these high-impact issues. We strongly recommend that all impacted users update to 2.40.1 immediately to protect the confidentiality, integrity and availability of their systems. Git updates for prior stable series are also available with v2.39.3, v2.38.5, v2.37.7, v2.36.6, v2.35.8, v2.34.8, v2.33.8, v2.32.7, v2.31.8, and v2.30.9.

Your Related Advisories:

[distro_list_2]

Netty

The Discovery

Several remotely exploitable request smuggling, memory exhaustion, and HTTP response splitting vulnerabilities have been discovered in the Netty Java NIO client/server socket framework.

The Impact

These vulnerabilities could result in crashes leading to denial of service (DoS), the exposure of sensitive information, request smuggling attacks and HTTP response splitting attacks.

The Fix

An important update for Netty that fixes these dangerous bugs has been released. We urge all impacted users to apply the Netty updates issued but their distro(s) now to secure against exploits leading to downtime and compromise.