CVE-2023-28327

What it actually does

A NULL pointer dereference in unix_diag_get_exact allows a local process to trigger a kernel panic by causing the newly allocated skb to lack an associated sk pointer during UNIX socket diagnostics.

Why it matters to the business

Local users on affected Linux systems can trigger denial of service, leading to unplanned reboots, service interruptions, and potential data loss in production workloads; the age of the issue and availability of fixes reduce urgency for most environments.

How an attack unfolds

An attacker with local low-privileged access invokes the UNIX diag interface to request exact socket information; the kernel allocates an skb without setting the sk field, dereferences the NULL pointer, and crashes the system.

How to fix it

Update the Linux kernel to the fixed commit 4fe89d07dcc2804c8b562f6c7896a45643d34b2f or later; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Confirm the running kernel contains commit 4fe89d07dcc2804c8b562f6c7896a45643d34b2f by checking git log or kernel version strings; attempt reproduction of the diag call in a test environment to verify the crash is no longer possible.

Typical attack path

1. Obtain local shell or process execution on the target Linux host
2. Invoke netlink socket diagnostics targeting UNIX protocol with crafted parameters
3. Trigger unix_diag_get_exact path that allocates skb without sk assignment
4. Cause NULL dereference resulting in kernel oops and system crash or reboot

How to detect it

Review kernel logs (dmesg, /var/log/kern.log, journalctl) for oops or panic messages referencing unix_diag_get_exact or net/unix/diag.c; correlate with user activity around the time of crashes.

What your security team should do

• Apply the kernel patch containing 4fe89d07dcc2804c8b562f6c7896a45643d34b2f on all Linux hosts
• Restrict local user access to netlink diagnostics interfaces where feasible via capabilities or seccomp
• Monitor kernel crash logs for NULL pointer dereferences in unix_diag paths during the transition period