CVE-2023-28466 Overview
CVE-2023-28466 is a race condition vulnerability in the Linux kernel's Kernel TLS (kTLS) subsystem. The flaw resides in the do_tls_getsockopt function in net/tls/tls_main.c and affects Linux kernel versions through 6.2.6. The function fails to invoke lock_sock before accessing socket state, allowing concurrent operations to corrupt kernel memory. Successful exploitation can trigger a use-after-free condition or a NULL pointer dereference [CWE-476]. The vulnerability also impacts Debian Linux 10 and several NetApp HCI storage appliances that ship with the affected kernel.
Critical Impact
A local authenticated attacker can race getsockopt calls against socket teardown to corrupt kernel memory, enabling privilege escalation or kernel denial of service.
Affected Products
- Linux Kernel through version 6.2.6
- Debian Linux 10.0
- NetApp HCI compute and storage nodes (H300S, H410C, H410S, H500S, H700S)
Discovery Timeline
- 2023-03-16 - CVE-2023-28466 published to NVD
- 2023-04-27 - NetApp publishes security advisory NTAP-20230427-0006
- 2023-05 - Debian LTS announcement released for affected packages
- 2025-05-05 - Last updated in NVD database
Technical Details for CVE-2023-28466
Vulnerability Analysis
The vulnerability exists in the Linux kernel TLS implementation, which offloads symmetric TLS record processing to the kernel. The do_tls_getsockopt function services getsockopt requests for TLS-enabled sockets but does not hold the socket lock while reading socket state. Without lock_sock, another thread can mutate or release socket structures concurrently. The resulting race produces either a use-after-free on freed TLS context memory or a NULL pointer dereference when context fields are torn down mid-read.
The issue is reachable from unprivileged user space on any system where TLS sockets can be created. Exploitation requires local access and elevated timing precision, reflected in the high attack complexity. Successful manipulation of freed kernel memory can lead to kernel-mode code execution and full privilege escalation.
Root Cause
The root cause is missing serialization. The do_tls_getsockopt handler reads fields from struct tls_context and related socket state without acquiring the per-socket mutex via lock_sock. Sibling paths that set options, close the socket, or replace the TLS context expect callers to hold this lock. The omission breaks the socket subsystem's locking contract.
Attack Vector
An attacker with local shell access creates a TLS socket via the tls ULP (setsockopt(SOL_TCP, TCP_ULP, "tls")). They then invoke getsockopt on the socket in one thread while concurrently destroying or reconfiguring the socket from another. Repeated racing produces memory corruption that can be shaped into a controlled use-after-free primitive.
No verified public proof-of-concept code is available for this CVE. See the upstream kernel commit 49c47cc21b5b for the precise code path and remediation.
Detection Methods for CVE-2023-28466
Indicators of Compromise
- Kernel oops or panic messages referencing do_tls_getsockopt, tls_main.c, or tls_context in dmesg and /var/log/kern.log
- Unexpected segmentation faults in processes using the kernel TLS ULP
- Unprivileged processes spawning rapid concurrent threads issuing setsockopt/getsockopt against TLS sockets
Detection Strategies
- Audit installed kernel versions against the fixed upstream commit 49c47cc21b5b and distribution backports
- Hunt for processes invoking setsockopt with TCP_ULP=tls from non-standard binaries using auditd or eBPF tracing
- Correlate kernel crash telemetry referencing TLS symbols with the originating process and user identity
Monitoring Recommendations
- Forward kernel ring buffer and kern.log events to a centralized logging platform for retention and alerting
- Alert on repeated kernel NULL pointer dereferences or general protection faults on the same host within short windows
- Track local privilege escalation primitives by monitoring setuid, capability changes, and unexpected root shells following kernel faults
How to Mitigate CVE-2023-28466
Immediate Actions Required
- Apply the latest kernel updates from your distribution vendor that incorporate upstream commit 49c47cc21b5b
- Update Debian 10 systems via the Debian LTS Announcement
- Update NetApp HCI nodes following NetApp Security Advisory NTAP-20230427-0006
- Restrict local shell access on multi-tenant systems until patches are deployed
Patch Information
The upstream fix adds the missing lock_sock/release_sock pair around the socket state access in do_tls_getsockopt. Review the Linux Kernel Commit for the authoritative change. Stable kernel series 5.4, 5.10, 5.15, 6.1, and 6.2 received backports through downstream distributions.
Workarounds
- Disable the kernel TLS ULP by blacklisting the tls module if TLS offload is not required: add blacklist tls under /etc/modprobe.d/
- Restrict creation of TLS sockets by limiting which users can load kernel modules and use raw socket options
- Enforce least privilege for local accounts and remove shell access for service identities
# Verify whether the tls module is loaded and disable it if unused
lsmod | grep '^tls'
echo 'blacklist tls' | sudo tee /etc/modprobe.d/disable-ktls.conf
sudo rmmod tls 2>/dev/null || true
# Confirm patched kernel version after update
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
