Race Condition in Linux Kernel's Socket Management Leading to Use After Free

CVE-2023-53836

What is CVE-2023-53836?

A race condition in the Linux Kernel's socket management could lead to a use-after-free situation with sk_buff structures. When an application reads and subsequently frees a sk_buff, a reference to that sk_buff can still exist in the socket backlog. Consequently, if this reference is dequeued after the sk_buff has been freed, it can result in undefined behavior and general protection faults. To mitigate this issue, a revision was introduced that includes an skb_get() call before the enqueueing process, ensuring that the sk_buff remains valid, thus preventing the potential for use-after-free vulnerabilities.

References