CVE-2023-28466

Public on 2023-03-16
Modified on 2024-01-12
Description
do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a resultant use-after-free or NULL pointer dereference).
Severity
Important severity
Important
CVSS v3 Base Score
7.0
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 kernel 2023-06-21 ALAS-2023-1773 Fixed
Amazon Linux 2 - Core kernel 2023-06-21 ALAS2-2023-2100 Fixed
Amazon Linux 2 - Kernel-5.10 Extra kernel 2023-04-13 ALAS2KERNEL-5.10-2023-029 Fixed
Amazon Linux 2 - Kernel-5.15 Extra kernel 2023-04-13 ALAS2KERNEL-5.15-2023-016 Fixed
Amazon Linux 2 - Kernel-5.4 Extra kernel 2023-04-27 ALAS2KERNEL-5.4-2023-044 Fixed
Amazon Linux 2023 kernel 2023-03-30 ALAS2023-2023-148 Fixed
Amazon Linux 2 - Livepatch Extra kernel-livepatch-4.14.309-231.529 2023-06-21 ALAS2LIVEPATCH-2023-133 Fixed
Amazon Linux 2 - Livepatch Extra kernel-livepatch-4.14.311-233.529 2023-06-21 ALAS2LIVEPATCH-2023-132 Fixed
Amazon Linux 2 - Livepatch Extra kernel-livepatch-4.14.313-235.533 2023-06-21 ALAS2LIVEPATCH-2023-130 Fixed
Amazon Linux 2 - Livepatch Extra kernel-livepatch-4.14.314-237.533 2023-06-21 ALAS2LIVEPATCH-2023-129 Fixed
Amazon Linux 2 - Livepatch Extra kernel-livepatch-4.14.314-238.539 2023-06-21 ALAS2LIVEPATCH-2023-128 Fixed
Amazon Linux 2 - Livepatch Extra kernel-livepatch-5.10.162-141.675 2023-04-13 ALAS2LIVEPATCH-2023-121 Fixed
Amazon Linux 2 - Livepatch Extra kernel-livepatch-5.10.165-143.735 2023-04-13 ALAS2LIVEPATCH-2023-120 Fixed
Amazon Linux 2 - Livepatch Extra kernel-livepatch-5.10.167-147.601 2023-04-13 ALAS2LIVEPATCH-2023-119 Fixed
Amazon Linux 2 - Livepatch Extra kernel-livepatch-5.10.173-154.642 2023-04-13 ALAS2LIVEPATCH-2023-118 Fixed
Amazon Linux 2 - Livepatch Extra kernel-livepatch-5.10.176-157.645 2023-06-21 ALAS2LIVEPATCH-2023-131 Fixed
Amazon Linux 2023 kernel-livepatch-6.1.15-28.43 2023-04-13 ALAS2023LIVEPATCH-2023-003 Fixed
Amazon Linux 2023 kernel-livepatch-6.1.19-30.43 2023-04-13 ALAS2023LIVEPATCH-2023-002 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD CVSSv3 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H