CVE-2023-4206 - Use-After-Free Vulnerability in Linux Kernel’s cls_route May Lead to Local Privilege Escalation

A serious security flaw known as CVE-2023-4206 affects the Linux kernel, specifically the cls_route traffic control subsystem under net/sched. This vulnerability is a use-after-free bug that can be abused by local attackers to get root privileges—a classic privilege escalation attack.

This article explains in simple terms how the bug works, who’s affected, how to check your kernel version, how exploitation can look like, and what you can do to protect yourself.

What’s the Problem? Understanding Use-After-Free in cls_route

The Linux kernel has a subsystem called traffic control (TC), which allows shaping, filtering, or prioritizing network traffic. The cls_route classifier lets administrators organize packets into classes.

The vulnerability is in the route4_change() function, used when updating an existing filter. Here’s the core issue:

- The kernel copies a tcf_result struct from the old filter to the new one, instead of creating a fresh reference.
- Afterwards, it calls tcf_unbind_filter() on the old filter, which decreases a reference counter (filter_cnt) on a still-in-use class.
- If the class now gets deleted, but someone else (like the new filter) still references it, you end up with a "use-after-free": using memory that was already freed.

This allows a local attacker to manipulate kernel memory, potentially gaining arbitrary code execution as root.

Reference Links

- CVE-2023-4206 at National Vulnerability Database (NVD)
- Kernel patch commit: b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8
- Linux Kernel bug tracker discussion
- Upstream commit diff (code level)

Here's a simplified version of the vulnerable code (taken from net/sched/cls_route.c)

// Vulnerable path in route4_change()
struct route4_filter *new_filter = kzalloc(...);
*new_filter = *old_filter; // copies tcf_result (bad, shallow copy!)

success:
    tcf_unbind_filter(tp, &old_filter->res, base);
    ...

The critical point is that the pointer in old_filter->res (of type struct tcf_result) is copied to the new filter without increasing the reference counter. When the cleanup function tcf_unbind_filter() is called, it decreases the counter, possibly freeing the underlying class still in use by the new filter.

Who can exploit?

- Any local user with the ability to run programs or scripts. No special capabilities needed, just access to the TC subsystem (typically, local unprivileged users).

The attacker creates a traffic control class and attaches a route filter to it.

- The attacker then triggers an update using route4_change() on the filter, which causes the faulty reference management.
- By careful timing (or in a tight loop), the attacker causes the original class to be deleted while still in use.

Simple Exploit Sketch (Pseudocode)

// 1. Create tc class and attach filter
system("tc qdisc add dev eth root handle 1: htb");
system("tc class add dev eth parent 1: classid 1:1 htb rate 1mbit");
system("tc filter add dev eth parent 1: protocol ip prio 1 route4 classid 1:1");

// 2. Trigger update (route4_change())
system("tc filter change dev eth parent 1: protocol ip prio 1 route4 classid 1:1");

// 3. In background, repeatedly delete and add class to trigger use-after-free
while(1) {
  system("tc class del dev eth classid 1:1");
  system("tc class add dev eth parent 1: classid 1:1 htb rate 1mbit");
}

Note: A full exploit would require more precise heap spraying and clean-up, plus actual payload code. But you can see the gist—by racing class deletion, you can get the kernel to use freed memory.

To check your kernel version

uname -r

- If your kernel is older than the fix commit b80b829e9e2c, you're likely vulnerable.

Mitigations and Patch

The best fix is to upgrade your kernel version past b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8. Modern distributions have backported the fix into their security releases.

- Direct patch diff
- Ubuntu security notice
- Red Hat advisory

Conclusion

CVE-2023-4206 is a powerful local privilege escalation affecting many Linux systems. The root cause is improper memory and reference management in the kernel’s traffic control route classifier—letting attackers race the kernel into using freed memory. If you run any modern Linux server or desktop, you should update as soon as possible!

For full technical details and code, see the original kernel patch and discussion.

Timeline

Published on: 09/06/2023 14:15:11 UTC
Last modified on: 09/11/2023 17:57:25 UTC