Use-After-Free Vulnerability Present in Linux Kernel

Summary

A Use-After-Free (UAF) vulnerability has been identified in the Linux kernel which is identified as CVE-2023-40283 with a CVSS 3.1 score of 7.8 HIGH. The issue was discovered in l2cap_sock_release in /net/Bluetooth/l2cap_sock.c in versions of the linux kernel before 6.4.10. This is one of several recent vulnerabilities associated with the Linux kernel which all allow for a Secure Boot Bypass. The collection of vulnerabilities dubbed LogoFAIL leverages the UEFI BIOs capabilities of displaying images during boot to achieve arbitrary code execution and compromise the security of the entire system.

Impact Assessment

Use-After-Free (UAF) is a memory vulnerability that occurs when a program continues to access memory that has already been freed. This can happen when a program does not clear the pointer to a memory location after freeing it. This vulnerability impacts several Linux distributions such as Debian and Ubuntu. It was quoted affecting all versions of the Linux Kernel up to 6.4.10.

This also impacts a number of NetApp products.

1. NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S
2. NetApp HCI Baseboard Management Controller (BMC) - H410C
3. NetApp SolidFire & HCI Management Node
4. NetApp SolidFire & HCI Storage Node (Element Software)

This vulnerability was part of a chain of vulnerabilities used to compromise secure boot on a system. If exploited an advanced persistent threat can be installed on the device and will be near impossible to remove.

What it means for you

Review your organization’s software inventory for any installations of Linux. If any installations of it are found, determine whether an update is feasible for your organization.

Remediation

Update the Linux distributions Ubuntu and Debian to a Linux Kernel version at or above 6.4.10

NetApp has ended the availability of the NetApp HCI Baseboard Management Controllers mentioned above, so no updates to or patches for these controllers will be made available.

Business Implications

An attacker leveraging this vulnerability could, at the very least, perform arbitrary code execution on the system. However, using it in conjunction with other vulnerabilities could allow for a secure boot UEFI bypass allowing the execution of code before the OS. This would cause the device to potentially be permanently hacked due to the possibility of an advanced persistent threat being installed on the machine. This could cause data exfiltration and complete takeover of the machine. Monetary and data loss are the main losses expected from this type of attack.

Access Point Technology Recommends

1. Patch: Patch the affected Linux distributions as soon as possible to remediate not only this vulnerability, but several others.
2. Harden: Due to this vulnerability requiring a local attacker hardening of the physical security and access control within the office space is crucial to prevent this vulnerability from being exploited.

Associated Bulletins

https://github.com/torvalds/linux/commit/1728137b33c00d5a2b5110ed7aafb42e7c32e4a1

https://packetstormsecurity.com/files/175963/Kernel-Live-Patch-Security-Notice-LSN-0099-1.html

https://www.blackhat.com/eu-23/briefings/schedule/index.html#logofail-security-implications-of-image-parsing-during-system-boot-35042