CVE-2023-3269

Published: 11 July 2023

A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitrary kernel code, escalate containers, and gain root privileges.

From the Ubuntu Security Team

Ruihan Li discovered that the memory management subsystem in the Linux kernel contained a race condition when accessing VMAs in certain conditions, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code.

Notes

Priority reason:
Local privilege escalation to root

aka StackRot
introduced in v6.1 kernels, so only affects kernels in
23.04 and linux-oem-6.1

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3269
• https://github.com/lrh2000/StackRot
• https://www.openwall.com/lists/oss-security/2023/07/05/1
• https://ubuntu.com/security/notices/USN-6249-1
• https://ubuntu.com/security/notices/USN-6250-1
• NVD
• Launchpad
• Debian