https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 03:00:06 +0000 https://vulnerability.circl.lu/vuln/cve-2023-0461 <p><strong>Affected:</strong> Linux Kernel</p> <p>There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.</p> <p>There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.</p> <p>When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable.</p> <p>The setsockopt TCP_ULP operation does not require any privilege.</p> <p>We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c</p> <p><strong>Affected:</strong> Linux Kernel</p> <p>There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not require any privilege.</p> <p>There is a use-after-free bug of icsk_ulp_data of a struct inet_connection_sock.</p> <p>When CONFIG_TLS is enabled, user can install a tls context (struct tls_context) on a connected tcp socket. The context is not cleared if this socket is disconnected and reused as a listener. If a new socket is created from the listener, the context is inherited and vulnerable.</p> <p>The setsockopt TCP_ULP operation does not require any privilege.</p> <p>We recommend upgrading past commit 2c02d41d71f90a5168391b6a5f2954112ba2307c</p> https://vulnerability.circl.lu/vuln/cve-2023-0461