CVE-2023-1829

What it actually does

Use-after-free in tcindex_delete allows double-free of filter structures when perfect hashes are used during deletion of the underlying data structure.

Why it matters to the business

Local attackers on affected Linux systems can obtain root privileges, fully compromising the host, its data, and all services running on it; widespread kernel deployments increase exposure across servers and endpoints.

How an attack unfolds

A local unprivileged user invokes tc commands to install and then delete traffic-control index filters that trigger perfect-hash handling, leaving a dangling reference that the attacker later reuses via the freed memory to escalate to root.

How to fix it

Upgrade the Linux kernel to a version containing commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28 or later; apply the corresponding security update from the distribution vendor.

How to confirm the fix worked

Verify the running kernel contains commit 8c710f75256bb3cf05ac7b1672c82b92c43f3d28 or is newer than the vulnerable release; confirm the tcindex code path no longer exhibits the double-free condition via source review or regression tests.

Typical attack path

1. Obtain local shell as an unprivileged user
2. Use tc to create and delete index filters exercising perfect-hash paths
3. Trigger the double-free condition in tcindex_delete
4. Leverage the resulting use-after-free for kernel memory corruption and privilege escalation

How to detect it

Review audit logs and kernel messages for tc filter operations immediately preceding unexpected privilege changes or crashes; inspect /var/log/audit/audit.log and dmesg for tcindex-related activity around the time of suspected escalation.

• tcindex_delete
• perfect hash filter deletion
• use-after-free in traffic control index

What your security team should do

• Prioritize kernel updates on all Linux hosts within the next maintenance window
• Restrict local interactive access for untrusted users until patches are deployed
• Enable kernel hardening features such as KASLR and SMEP where supported