OSG-SEC-2023-05-18 HIGH Linux kernel user-after-free flaw in TLS protocol

Dear OSG Security Contacts,

A use-after-free flaw was found in the Linux kernel's TLS protocol functionality in how a user installs a TLS context (struct tls_context) on a connected TCP socket (CVE-2023-0461). [1][3]

IMPACTED VERSIONS:

RHEL 8 and 9 based distributions

WHAT ARE THE VULNERABILITIES:

This flaw allows a local user to crash or potentially escalate their privileges on the system. [1][2]

WHAT YOU SHOULD DO:

Update your Linux kernel to the latest patched version. Updated kernel packages for all impacted RHEL based distributions are now available. It may take a few more days for them to show up in CentOS. [5]

If you are unable to update your kernel, Red Hat recommends the following:

To mitigate this issue, prevent module 'tls' from being loaded. Please see [4] for how to blacklist a kernel module to prevent it from loading automatically.

Note: RHEL 7 based distributions, like Scientific Linux, are not affected.

REFERENCES

[1] https://access.redhat.com/security/cve/CVE-2023-0461

[2] https://bugzilla.redhat.com/show_bug.cgi?id=2176192

[3] https://nvd.nist.gov/vuln/detail/CVE-2023-0461

[4] https://access.redhat.com/solutions/41278

[5] http://mirror.centos.org/centos/

Please contact the OSG security team at [email protected] if you have any questions or concerns.

OSG Security Team