Bug 1210447 (CVE-2023-2006) - VUL-0: CVE-2023-2006: kernel: RxRPC Race Condition Privilege Escalation Vulnerability
Summary: VUL-0: CVE-2023-2006: kernel: RxRPC Race Condition Privilege Escalation Vulne...
Status: RESOLVED FIXED
Alias: CVE-2023-2006
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/363441/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-2006:7.8:(AV:L...
Keywords:
Depends on: 1210457
Blocks:
  Show dependency tree / graph
 
Reported: 2023-04-14 07:26 UTC by Robert Frohl
Modified: 2024-05-06 12:22 UTC (History)
13 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
reproducer (deleted)
2023-04-20 14:20 UTC, Andreas Wiesenstahl 		Details
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Frohl 2023-04-14 07:26:14 UTC 
CVE-2023-2006

This vulnerability allows local attackers to escalate privileges on affected
installations of Linux Kernel. An attacker must first obtain the ability to
execute low-privileged code on the target system in order to exploit this
vulnerability.

The specific flaw exists within the processing of RxRPC bundles. The issue
results from the lack of proper locking when performing operations on an object.
An attacker can leverage this vulnerability to escalate privileges and execute
code in the context of the kernel.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-2006
https://www.zerodayinitiative.com/advisories/ZDI-23-439/
https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=3bcd6c7eaa53
Comment 2 Chester Lin 2023-04-14 08:00:25 UTC 
Reassigning to a concrete person to ensure progress [1] (feel free to pass to the next one), see also the process at [2].

Hi Michal,
 
This is a vulnerability of net/rxrpc, could you please take a look? Thanks.
 
[1] https://confluence.suse.com/display/KSS/Kernel+Security+Sentinel
[2] https://wiki.suse.net/index.php/SUSE-Labs/Kernel/Security
Comment 7 Dmitrii Puzikov 2023-04-26 10:49:55 UTC 
The content of attachment 866442 [details] has been deleted for the following reason:

https://sd.suse.com/browse/SD-119302
Comment 11 Vasant Karasulli 2023-05-10 07:35:37 UTC 
This bug seems to approach a good date for CVE SLA fulfillment [1]..  Michal,  is there any update on this?
 
[1] https://confluence.suse.com/display/KSS/Kernel+Security+Sentinel
Comment 12 Michal Kubeček 2023-05-10 08:04:23 UTC 
No change, backporting the fix is easy but I'm still trying to come with
a way to work around the kABI breakage.
Comment 19 Petr Mladek 2023-06-16 09:13:21 UTC 
Just an idea. There is the shadow variables API. It was developed for livepatches but it might be used anywhere, see Documentation/livepatch/shadow-vars.rst
A real life example is in lib/livepatch/test_klp_shadow_vars.c.

One problem might be performance. The shadow data are searched using a hash table
and list of pointers with the same hash. Also the API takes a spin lock.
See kernel/livepatch/shadow.c.

There are more possible problems, for example, with leaked shadow variables. They might be later associated with a newly allocated structure on the same address.
Comment 25 Simon Logan 2023-10-03 10:26:49 UTC 
Hi folks,

Is there any further update on this investigation?
I need a fix for Leap 15.4.

Thanks,
Simon
Comment 26 Petr Mladek 2023-10-20 09:06:07 UTC 
Gently ping.
Comment 27 Marcos de Souza 2023-11-01 14:52:58 UTC 
Humble ping
Comment 30 Michal Kubeček 2023-11-29 20:36:57 UTC 
introduced      245500d853e9    5.10-rc1
fixed           3bcd6c7eaa53    6.1-rc7

The fix has been submitted to SLE15-SP4 branch with net/rxrpc/* added as an
exception to kabi/severities. The offending commit has not been backported
to any older branch.

SLE15-SP4       88c559c4aa6b

Reassigning back to security team.
Comment 39 Maintenance Automation 2023-12-12 16:30:01 UTC 
SUSE-SU-2023:4732-1: An update that solves 15 vulnerabilities, contains three features and has 39 security fixes can now be installed.

Category: security (important)
Bug References: 1207948, 1210447, 1212649, 1214286, 1214700, 1214840, 1214976, 1215095, 1215123, 1215124, 1215292, 1215420, 1215458, 1215710, 1215802, 1215931, 1216058, 1216105, 1216259, 1216527, 1216584, 1216621, 1216687, 1216693, 1216759, 1216761, 1216788, 1216844, 1216861, 1216909, 1216959, 1216965, 1216976, 1217036, 1217068, 1217086, 1217095, 1217124, 1217140, 1217147, 1217195, 1217196, 1217200, 1217205, 1217332, 1217366, 1217511, 1217515, 1217598, 1217599, 1217609, 1217687, 1217731, 1217780
CVE References: CVE-2023-2006, CVE-2023-25775, CVE-2023-3777, CVE-2023-39197, CVE-2023-39198, CVE-2023-4244, CVE-2023-45863, CVE-2023-45871, CVE-2023-46813, CVE-2023-46862, CVE-2023-5158, CVE-2023-5633, CVE-2023-5717, CVE-2023-6039, CVE-2023-6176
Jira References: PED-3184, PED-5021, PED-7237
Sources used:
openSUSE Leap 15.5 (src): kernel-source-rt-5.14.21-150500.13.27.2, kernel-syms-rt-5.14.21-150500.13.27.1, kernel-livepatch-SLE15-SP5-RT_Update_8-1-150500.11.3.2
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5-RT_Update_8-1-150500.11.3.2
SUSE Real Time Module 15-SP5 (src): kernel-source-rt-5.14.21-150500.13.27.2, kernel-syms-rt-5.14.21-150500.13.27.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 40 Maintenance Automation 2023-12-12 16:30:14 UTC 
SUSE-SU-2023:4731-1: An update that solves 12 vulnerabilities, contains three features and has 28 security fixes can now be installed.

Category: security (important)
Bug References: 1084909, 1189998, 1210447, 1214286, 1214976, 1215124, 1215292, 1215420, 1215458, 1215710, 1216058, 1216105, 1216259, 1216584, 1216693, 1216759, 1216761, 1216844, 1216861, 1216909, 1216959, 1216965, 1216976, 1217036, 1217068, 1217086, 1217124, 1217140, 1217195, 1217200, 1217205, 1217332, 1217366, 1217515, 1217598, 1217599, 1217609, 1217687, 1217731, 1217780
CVE References: CVE-2023-2006, CVE-2023-25775, CVE-2023-39197, CVE-2023-39198, CVE-2023-4244, CVE-2023-45863, CVE-2023-45871, CVE-2023-46862, CVE-2023-5158, CVE-2023-5717, CVE-2023-6039, CVE-2023-6176
Jira References: PED-3184, PED-5021, PED-7237
Sources used:
openSUSE Leap 15.4 (src): kernel-source-rt-5.14.21-150400.15.62.1, kernel-syms-rt-5.14.21-150400.15.62.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4-RT_Update_16-1-150400.1.3.1
SUSE Real Time Module 15-SP4 (src): kernel-source-rt-5.14.21-150400.15.62.1, kernel-syms-rt-5.14.21-150400.15.62.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 41 Maintenance Automation 2023-12-12 16:30:31 UTC 
SUSE-SU-2023:4734-1: An update that solves 13 vulnerabilities, contains three features and has 38 security fixes can now be installed.

Category: security (important)
Bug References: 1084909, 1207948, 1210447, 1214286, 1214700, 1214840, 1214976, 1215123, 1215124, 1215292, 1215420, 1215458, 1215710, 1215802, 1215931, 1216058, 1216105, 1216259, 1216527, 1216584, 1216687, 1216693, 1216759, 1216788, 1216844, 1216861, 1216909, 1216959, 1216965, 1216976, 1217036, 1217068, 1217086, 1217095, 1217124, 1217140, 1217147, 1217195, 1217196, 1217200, 1217205, 1217332, 1217366, 1217511, 1217515, 1217598, 1217599, 1217609, 1217687, 1217731, 1217780
CVE References: CVE-2023-2006, CVE-2023-25775, CVE-2023-39197, CVE-2023-39198, CVE-2023-4244, CVE-2023-45863, CVE-2023-45871, CVE-2023-46862, CVE-2023-5158, CVE-2023-5633, CVE-2023-5717, CVE-2023-6039, CVE-2023-6176
Jira References: PED-3184, PED-5021, PED-7237
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-azure-5.14.21-150500.33.26.1, kernel-source-azure-5.14.21-150500.33.26.1
Public Cloud Module 15-SP5 (src): kernel-syms-azure-5.14.21-150500.33.26.1, kernel-source-azure-5.14.21-150500.33.26.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 42 Maintenance Automation 2023-12-12 16:30:47 UTC 
SUSE-SU-2023:4730-1: An update that solves 13 vulnerabilities, contains three features and has 38 security fixes can now be installed.

Category: security (important)
Bug References: 1084909, 1207948, 1210447, 1214286, 1214700, 1214840, 1214976, 1215123, 1215124, 1215292, 1215420, 1215458, 1215710, 1215802, 1215931, 1216058, 1216105, 1216259, 1216527, 1216584, 1216687, 1216693, 1216759, 1216788, 1216844, 1216861, 1216909, 1216959, 1216965, 1216976, 1217036, 1217068, 1217086, 1217095, 1217124, 1217140, 1217147, 1217195, 1217196, 1217200, 1217205, 1217332, 1217366, 1217511, 1217515, 1217598, 1217599, 1217609, 1217687, 1217731, 1217780
CVE References: CVE-2023-2006, CVE-2023-25775, CVE-2023-39197, CVE-2023-39198, CVE-2023-4244, CVE-2023-45863, CVE-2023-45871, CVE-2023-46862, CVE-2023-5158, CVE-2023-5633, CVE-2023-5717, CVE-2023-6039, CVE-2023-6176
Jira References: PED-3184, PED-5021, PED-7237
Sources used:
openSUSE Leap 15.5 (src): kernel-syms-5.14.21-150500.55.39.1, kernel-source-5.14.21-150500.55.39.1, kernel-livepatch-SLE15-SP5_Update_8-1-150500.11.3.1, kernel-obs-build-5.14.21-150500.55.39.1, kernel-obs-qa-5.14.21-150500.55.39.1, kernel-default-base-5.14.21-150500.55.39.1.150500.6.17.1
SUSE Linux Enterprise Micro 5.5 (src): kernel-default-base-5.14.21-150500.55.39.1.150500.6.17.1
Basesystem Module 15-SP5 (src): kernel-source-5.14.21-150500.55.39.1, kernel-default-base-5.14.21-150500.55.39.1.150500.6.17.1
Development Tools Module 15-SP5 (src): kernel-source-5.14.21-150500.55.39.1, kernel-syms-5.14.21-150500.55.39.1, kernel-obs-build-5.14.21-150500.55.39.1
SUSE Linux Enterprise Live Patching 15-SP5 (src): kernel-livepatch-SLE15-SP5_Update_8-1-150500.11.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 43 Maintenance Automation 2023-12-13 16:30:48 UTC 
SUSE-SU-2023:4782-1: An update that solves 12 vulnerabilities, contains three features and has 25 security fixes can now be installed.

Category: security (important)
Bug References: 1210447, 1214286, 1214976, 1215124, 1215292, 1215420, 1215458, 1215710, 1216058, 1216105, 1216259, 1216584, 1216693, 1216759, 1216844, 1216861, 1216909, 1216959, 1216965, 1216976, 1217036, 1217068, 1217086, 1217124, 1217140, 1217195, 1217200, 1217205, 1217332, 1217366, 1217515, 1217598, 1217599, 1217609, 1217687, 1217731, 1217780
CVE References: CVE-2023-2006, CVE-2023-25775, CVE-2023-39197, CVE-2023-39198, CVE-2023-4244, CVE-2023-45863, CVE-2023-45871, CVE-2023-46862, CVE-2023-5158, CVE-2023-5717, CVE-2023-6039, CVE-2023-6176
Jira References: PED-3184, PED-5021, PED-7237
Sources used:
openSUSE Leap 15.4 (src): kernel-source-azure-5.14.21-150400.14.75.1, kernel-syms-azure-5.14.21-150400.14.75.1
Public Cloud Module 15-SP4 (src): kernel-source-azure-5.14.21-150400.14.75.1, kernel-syms-azure-5.14.21-150400.14.75.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 44 Maintenance Automation 2023-12-13 20:30:33 UTC 
SUSE-SU-2023:4810-1: An update that solves 12 vulnerabilities, contains three features and has 26 security fixes can now be installed.

Category: security (important)
Bug References: 1084909, 1210447, 1214286, 1214976, 1215124, 1215292, 1215420, 1215458, 1215710, 1216058, 1216105, 1216259, 1216584, 1216693, 1216759, 1216844, 1216861, 1216909, 1216959, 1216965, 1216976, 1217036, 1217068, 1217086, 1217124, 1217140, 1217195, 1217200, 1217205, 1217332, 1217366, 1217515, 1217598, 1217599, 1217609, 1217687, 1217731, 1217780
CVE References: CVE-2023-2006, CVE-2023-25775, CVE-2023-39197, CVE-2023-39198, CVE-2023-4244, CVE-2023-45863, CVE-2023-45871, CVE-2023-46862, CVE-2023-5158, CVE-2023-5717, CVE-2023-6039, CVE-2023-6176
Jira References: PED-3184, PED-5021, PED-7237
Sources used:
openSUSE Leap 15.4 (src): kernel-obs-qa-5.14.21-150400.24.100.1, kernel-obs-build-5.14.21-150400.24.100.2, kernel-syms-5.14.21-150400.24.100.1, kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2, kernel-source-5.14.21-150400.24.100.2, kernel-livepatch-SLE15-SP4_Update_21-1-150400.9.3.2
openSUSE Leap Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2
openSUSE Leap Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2
SUSE Linux Enterprise Micro for Rancher 5.3 (src): kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2
SUSE Linux Enterprise Micro 5.3 (src): kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2
SUSE Linux Enterprise Micro for Rancher 5.4 (src): kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2
SUSE Linux Enterprise Micro 5.4 (src): kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2
Basesystem Module 15-SP4 (src): kernel-default-base-5.14.21-150400.24.100.2.150400.24.46.2, kernel-source-5.14.21-150400.24.100.2
Development Tools Module 15-SP4 (src): kernel-source-5.14.21-150400.24.100.2, kernel-obs-build-5.14.21-150400.24.100.2, kernel-syms-5.14.21-150400.24.100.1
SUSE Linux Enterprise Live Patching 15-SP4 (src): kernel-livepatch-SLE15-SP4_Update_21-1-150400.9.3.2

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 45 Robert Frohl 2024-05-06 12:22:45 UTC 
done, closing