CVE-2023-6546

What it actually does

Race condition in GSM 0710 tty multiplexor allows concurrent GSMIOC_SETCONF ioctls on the same file descriptor to trigger a use-after-free on struct gsm_dlci during gsm mux restart.

Why it matters to the business

Local users on affected Linux systems can gain elevated privileges, increasing risk of full system compromise in multi-user, container, or server environments where untrusted code executes.

How an attack unfolds

An attacker with local unprivileged access spawns two threads that simultaneously issue GSMIOC_SETCONF ioctls against a tty with the gsm line discipline enabled, racing the mux restart path to free a gsm_dlci structure while it is still referenced, then leverages the resulting use-after-free for privilege escalation.

How to fix it

Update the Linux kernel to a version containing commit 3c4f8333b582487a2d1e02171f1465531cde53e3 or later; rebuild and reboot with the patched kernel. Where immediate patching is not possible, restrict unprivileged access to tty devices and the GSM line discipline via LSMs or seccomp filters.

How to confirm the fix worked

Verify the running kernel contains commit 3c4f8333b582487a2d1e02171f1465531cde53e3 by inspecting /proc/version or the kernel build log; confirm the GSM 0710 driver no longer exhibits the double-ioctl race by code review or targeted fuzzing.

Typical attack path

1. Obtain local shell as unprivileged user
2. Open a tty device and set gsm line discipline
3. Spawn two threads that concurrently call GSMIOC_SETCONF ioctl on the same fd
4. Trigger mux restart to induce use-after-free on gsm_dlci
5. Exploit freed memory to corrupt kernel structures and escalate privileges

How to detect it

Review kernel audit logs and syscall traces for repeated GSMIOC_SETCONF ioctls on the same tty fd from a single process; look for unusual crashes or warnings referencing gsm_dlci or the GSM mux shortly before privilege-escalation attempts.

What your security team should do

• Prioritize kernel updates containing the referenced commit on all multi-user and internet-facing Linux hosts
• Audit systems for custom or legacy GSM/0710 tty usage and remove unnecessary line-discipline support
• Enable kernel hardening features such as KASAN, lockdep, and hardened usercopy where available
• Monitor for future Linux kernel updates and schedule recurring patch cycles