GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OESA-2023-1173 (CVE-2023-20938)

Vulnerability from osv_openeuler – Published: 2023-03-17 11:05 – Updated: 2026-08-06 11:05 – Source website
VLAI
Summary
kernel security update
Details

The Linux Kernel, the operating system core itself.

Security Fix(es):

In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257685302References: Upstream kernel(CVE-2023-20938)

There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c(CVE-2023-0461)

A flaw in the Linux Kernel found. Fail if no bound addresses can be used for a given scope. A type confusion can happen in inet_diag_msg_sctpasoc_fill() in net/sctp/diag.c, which uses a type confused pointer to return information to userspace when issuing a list_entry() on asoc->base.bind_addr.address_list.next when the list is empty.

References: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=458e279f861d3f61796894cd158b780765a1569f https://www.openwall.com/lists/oss-security/2023/01/23/1(CVE-2023-1074)

A flaw found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to struct rds_msg_zcopy_info *info actually points to something else that is potentially controlled by local user. It is known how to trigger this, which causes an OOB access, and a lock corruption.

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=f753a68980cf4b59a80fe677619da2b1804f526d(CVE-2023-1078)

A flaw found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters.

References: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=66b2c338adce580dfce2199591e65e2bab889cff https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=a096ccca6e503a5c575717ff8a36ace27510ab0a(CVE-2023-1076)

A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.(CVE-2023-1118)

In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device.(CVE-2023-26545)

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "python3-perf-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "perf-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "kernel-debugsource-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "kernel-debuginfo-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "kernel-tools-debuginfo-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "kernel-source-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "kernel-tools-devel-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "kernel-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "kernel-devel-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "kernel-tools-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "bpftool-debuginfo-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "perf-debuginfo-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "python3-perf-debuginfo-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "python2-perf-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "bpftool-4.19.90-2303.3.0.0192.oe1.aarch64.rpm",
          "python2-perf-debuginfo-4.19.90-2303.3.0.0192.oe1.aarch64.rpm"
        ],
        "src": [
          "kernel-4.19.90-2303.3.0.0192.oe1.src.rpm"
        ],
        "x86_64": [
          "python2-perf-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "kernel-debugsource-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "kernel-debuginfo-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "python3-perf-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "kernel-tools-devel-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "kernel-tools-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "perf-debuginfo-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "kernel-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "python3-perf-debuginfo-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "kernel-tools-debuginfo-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "bpftool-debuginfo-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "kernel-source-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "kernel-devel-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "perf-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "bpftool-4.19.90-2303.3.0.0192.oe1.x86_64.rpm",
          "python2-perf-debuginfo-4.19.90-2303.3.0.0192.oe1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP1",
        "name": "kernel",
        "purl": "pkg:rpm/openEuler/kernel\u0026distro=openEuler-20.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.19.90-2303.3.0.0192.oe1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257685302References: Upstream kernel(CVE-2023-20938)\r\n\r\nThere is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege. There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock. When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable. The setsockopt TCP_ULP operation does not require any privilege. We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c(CVE-2023-0461)\r\n\r\nA flaw in the Linux Kernel found. Fail if no bound addresses can be used for a given scope. A type confusion can happen in inet_diag_msg_sctpasoc_fill() in net/sctp/diag.c, which uses a type confused pointer to return information to userspace when issuing a list_entry() on asoc-\u0026gt;base.bind_addr.address_list.next when the list is empty.\r\n\r\nReferences:\nhttps://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=458e279f861d3f61796894cd158b780765a1569f\nhttps://www.openwall.com/lists/oss-security/2023/01/23/1(CVE-2023-1074)\r\n\r\nA flaw found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the head of a list causing a type confusion. Local user can trigger this with rds_message_put(). Type confusion leads to `struct rds_msg_zcopy_info *info` actually points to something else that is potentially controlled by local user.\nIt is known how to trigger this, which causes an OOB access, and a lock corruption.\r\n\r\nReference:\nhttps://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=f753a68980cf4b59a80fe677619da2b1804f526d(CVE-2023-1078)\r\n\r\nA flaw found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function.\nWhile it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability.\nThis would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters.\r\n\r\nReferences:\nhttps://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=66b2c338adce580dfce2199591e65e2bab889cff\nhttps://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=a096ccca6e503a5c575717ff8a36ace27510ab0a(CVE-2023-1076)\r\n\r\nA flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. A local user could use this flaw to crash the system or potentially escalate their privileges on the system.(CVE-2023-1118)\n\nIn the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registering the sysctl table under a new location) during the renaming of a device.(CVE-2023-26545)",
  "id": "OESA-2023-1173",
  "modified": "2026-08-06T11:05:39Z",
  "published": "2023-03-17T11:05:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1173"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20938"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0461"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1074"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1078"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1076"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-1118"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26545"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kernel security update",
  "upstream": [
    "CVE-2023-20938",
    "CVE-2023-0461",
    "CVE-2023-1074",
    "CVE-2023-1078",
    "CVE-2023-1076",
    "CVE-2023-1118",
    "CVE-2023-26545"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.