CVE-2023-4622

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free vulnerability in the Linux kernel's af unix component can be exploited to achieve local privilege escalation. The unix stream sendpage() function tries to add data to the last skb in the peer's recv queue without locking the queue, resulting in a race where unix stream sendpage() could access an skb locklessly that is being released by garbage collection, leading to use-after-free.

Recommendations Upgrade past commit 790c2f9d15b594350ae9bca7b236f2b1859de02c to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable unix stream sendpage() function until a patch is available.