CVE-2023-1078

What it actually does

Type confusion in rds_rm_zerocopy_callback() due to list_entry() misuse on list head, allowing local user-controlled data via rds_message_put() to cause out-of-bounds access and lock corruption in the RDS protocol.

Why it matters to the business

Local attackers on affected Linux systems can crash the kernel or escalate privileges, leading to denial of service or full system compromise on servers using the RDS protocol; patch urgency is moderate given low EPSS and no KEV status despite 1299 days since publication.

How an attack unfolds

A local user invokes rds_message_put() to trigger rds_rm_zerocopy_callback(), which misinterprets list head data as struct rds_msg_zcopy_info, resulting in controlled out-of-bounds memory access and lock corruption; no named threat actors or ransomware campaigns reported.

How to fix it

Update the Linux kernel to include commit 3eb67e3248e1d96ef4eaa43d9f5dc6ff2ba6db99 which resolves the list handling flaw in RDS; apply the fix across all affected distributions and verify with kernel build or package manager.

How to confirm the fix worked

Confirm kernel source contains commit 3eb67e3248e1d96ef4eaa43d9f5dc6ff2ba6db99 or test RDS message paths post-upgrade to ensure no type confusion occurs under rds_message_put() invocation.

Typical attack path

1. Obtain local user access on target Linux system
2. Load or trigger RDS protocol usage if not already active
3. Call rds_message_put() to invoke the vulnerable callback
4. Exploit resulting type confusion for out-of-bounds read/write or lock manipulation
5. Escalate to kernel-level code execution or cause system crash

How to detect it

Review kernel logs and crash dumps for RDS protocol errors or lock corruption around rds_rm_zerocopy_callback calls; no widespread exploitation indicators reported given low EPSS and false KEV status.

What your security team should do

• Prioritize kernel upgrade to the fixed commit in development and production environments using RDS
• Monitor for local privilege escalation attempts via kernel logging
• Disable RDS protocol if not required to reduce attack surface
• Review EPSS trend (stable at ~0.0025) and re-assess after any new exploit maturity changes