CVE-2023-1075

What it actually does

The tls_is_tx_ready() function in the Linux kernel TLS implementation performs an incorrect emptiness check on a list, allowing access to a type-confused list_head entry and leaking the last byte of an overlapping field from rec->tx_ready.

Why it matters to the business

Attackers with local access could potentially extract a single byte of kernel memory, which may contain sensitive information, though the impact is limited due to the small amount of data and requirement for local privileges.

How an attack unfolds

An attacker with local user access crafts input to trigger the TLS transmit ready check in a way that causes type confusion, reading and leaking one byte of adjacent kernel data through the confused pointer.

How to fix it

Update the Linux kernel to a version that includes the fix for this issue. Monitor kernel updates from distribution vendors for patches addressing the list emptiness check in TLS handling.

How to confirm the fix worked

Verify the kernel version is updated beyond the vulnerable release and test that the tls_is_tx_ready function behaves correctly without leaking data.

Typical attack path

1. Obtain local access to the system
2. Trigger the vulnerable TLS function with specific parameters
3. Observe the leaked byte from kernel memory

How to detect it

Examine system logs for unusual TLS-related kernel errors or accesses; monitor for processes attempting to exploit kernel memory leaks.

What your security team should do

• Apply available kernel patches promptly
• Restrict local access where possible
• Monitor for kernel updates from vendors