CVE-2023-52880

What it actually does

Unprivileged local users could attach the N_GSM0710 line discipline without requiring CAP_NET_ADMIN, bypassing the intended privilege boundary for GSM multiplexer operations in the kernel TTY subsystem.

Why it matters to the business

Attackers with local access on affected Linux systems could reach kernel networking features normally restricted to administrators, increasing risk of privilege escalation and system compromise on older Ubuntu deployments.

How an attack unfolds

A local unprivileged attacker invokes the TIOCSETD ioctl to attach N_GSM0710 to a TTY, then leverages the resulting GSM context to interact with kernel network interfaces that should have required administrative capability; no named threat actors are known to have used this path in the wild.

How to fix it

Upgrade affected packages to the listed fixed versions: linux 3.13.0-83.127 or 4.4.0-4.19, linux-aws 4.4.0-1002.2 or 4.4.0-1001.10, linux-lts-xenial 4.4.0-13.29~14.04.1, linux-gke 4.4.0-1003.3, linux-hwe 4.8.0-36.36~16.04.1, linux-raspi2 4.4.0-1003.4, linux-snapdragon 4.4.0-1012.12, linux-lts-utopic 3.16.0-67.87~14.04.1, linux-lts-vivid 3.19.0-56.62~14.04.1, linux-lts-wily 4.2.0-30.35~14.04.1.

How to confirm the fix worked

Verify running kernel package version matches or exceeds a fixed release; confirm the CAP_NET_ADMIN check is present by inspecting the n_gsm.c source or by attempting attachment as a non-root user in a test namespace.

Typical attack path

1. Obtain local unprivileged shell on target system
2. Identify a usable TTY device
3. Call TIOCSETD with N_GSM0710 to attach the line discipline
4. Create and configure GSM network interfaces without CAP_NET_ADMIN
5. Escalate via subsequent kernel operations reachable through the GSM context

How to detect it

Review kernel audit logs and TTY-related syslog entries for ioctl calls attaching N_GSM0710 by non-root processes; correlate with capability checks or LSM denials around GSM network interface creation.

• N_GSM0710
• TIOCSETD.*gsm
• gsm0
• gsm_mux

What your security team should do

• Prioritize patching all listed Ubuntu 14.04/16.04 kernel packages within the next maintenance window
• Restrict unprivileged TTY device access via device node permissions and user namespaces where possible
• Monitor for new kernel releases that backport the CAP_NET_ADMIN requirement