CVE-2023-4622

What it actually does

Use-after-free in Linux kernel AF_UNIX sockets caused by unix_stream_sendpage() locklessly accessing an skb being released by garbage collection, enabling local privilege escalation.

Why it matters to the business

Local attackers on affected Linux systems can gain root-level control, risking full system compromise across servers, desktops, and embedded devices using vulnerable kernels.

How an attack unfolds

An attacker with local access triggers a race between unix_stream_sendpage() and socket garbage collection on AF_UNIX sockets to cause use-after-free and escalate privileges; no named threat actors are known to be exploiting this specific issue.

How to fix it

Upgrade Linux kernel past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c or equivalent fixed commits such as 802aacbbffe2512dce9f8f33ad99d01cfec435de.

How to confirm the fix worked

Confirm kernel source contains the referenced fix commit or deploy updated distribution kernel packages and verify version.

Typical attack path

1. Obtain local user access on target Linux system
2. Create AF_UNIX sockets and trigger concurrent sendpage and garbage collection operations
3. Leverage resulting use-after-free for kernel memory corruption and privilege escalation

How to detect it

Review kernel logs for AF_UNIX related crashes or warnings around unix_stream_sendpage and garbage collection; no public exploitation artifacts are known.

What your security team should do

• Apply the kernel fix immediately on all affected systems
• Limit local user access and harden AF_UNIX socket usage where feasible
• Monitor kernel logs for related crashes or anomalies