CVE-2023-0461

What it actually does

Use-after-free in icsk_ulp_data of struct inet_connection_sock when a TLS context installed via setsockopt TCP_ULP on a connected TCP socket is not cleared on disconnect/reuse as listener and is inherited by a child socket; reachable with CONFIG_TLS or CONFIG_XFRM_ESPINTCP enabled and without privileges.

Why it matters to the business

Local attackers on affected Linux systems can escalate privileges to root, enabling full host compromise, data access, or persistence; widespread kernel exposure increases risk across servers and endpoints though public exploitation remains low.

How an attack unfolds

An attacker with local access creates a TCP socket, installs a TLS context, disconnects and reuses the socket as a listener, accepts a new connection that inherits the stale context, and triggers the use-after-free to corrupt kernel memory for privilege escalation.

How to fix it

Upgrade the Linux kernel to a version containing commit 2c02d41d71f90a5168391b6a5f2954112ba2307c or later; rebuild and reboot with the patched kernel; disable CONFIG_TLS and CONFIG_XFRM_ESPINTCP if the features are unused.

How to confirm the fix worked

Confirm kernel source contains commit 2c02d41d71f90a5168391b6a5f2954112ba2307c or verify running kernel version against distribution backports; test that TCP_ULP operations on reused listener sockets no longer trigger use-after-free under the affected configurations.

Typical attack path

1. Obtain local shell on target Linux host
2. Create connected TCP socket and call setsockopt TCP_ULP to attach TLS context
3. Disconnect socket and convert it into a listening socket
4. Accept new connection from listener to inherit dangling icsk_ulp_data pointer
5. Perform operations that dereference the freed context to achieve memory corruption and root privileges

How to detect it

Review kernel audit logs and system call traces for unusual sequences of socket creation, TCP_ULP setsockopt calls followed by listen/accept on the same socket descriptor; inspect crash dumps for references to freed inet_connection_sock objects under TLS configurations.

What your security team should do

• Apply the kernel patch containing commit 2c02d41d71f90a5168391b6a5f2954112ba2307c on all systems within the next maintenance window
• Audit kernel configurations to determine exposure of CONFIG_TLS and CONFIG_XFRM_ESPINTCP
• Monitor for new public exploits given the low barrier to exploitation
• Harden systems by removing unnecessary local user accounts and enforcing least privilege