CVE-2023-4623

What it actually does

Use-after-free in Linux kernel HFSC qdisc due to init_vf() inserting a vttree node on a parent without FSC while update_vf() skips removal, leaving a dangling pointer that can be dereferenced for arbitrary kernel code execution.

Why it matters to the business

Local attackers can obtain full root privileges on affected Linux systems, enabling complete host takeover, data theft, persistence, or lateral movement with high urgency for servers and containers running unpatched kernels.

How an attack unfolds

An attacker with local shell access configures an HFSC traffic-control class hierarchy that triggers the missing vttree_remove path, reclaims the freed object, and hijacks kernel control flow to escalate privileges.

How to fix it

Upgrade the Linux kernel to include commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f or later; rebuild and reboot all affected systems; rebuild any custom kernel modules against the patched source.

How to confirm the fix worked

Verify kernel source contains commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f; run 'uname -r' and compare against distribution security updates; attempt reproduction of the HFSC class configuration in a test environment to confirm the UAF no longer occurs.

Typical attack path

1. Obtain local unprivileged shell on target Linux host
2. Load or attach to a network interface and install HFSC qdisc with a parent lacking FSC and child possessing FSC
3. Trigger the dangling pointer via class modification or deletion operations
4. Perform heap grooming or object reuse to control the freed vttree structure
5. Execute kernel ROP or write-what-where to gain root credentials

How to detect it

Search kernel logs and audit trails for oops/panic entries mentioning hfsc, vttree_insert, or vttree_remove; inspect process creation events following suspicious tc qdisc add/del operations on HFSC classes.

What your security team should do

• Immediately apply the referenced kernel commit or vendor backport on all production systems
• Restrict unprivileged users from loading or modifying qdisc schedulers via capabilities or seccomp filters where possible
• Monitor for kernel oops or panic messages referencing sch_hfsc or vttree
• Prioritize patching on multi-tenant or internet-facing hosts given the local escalation risk