CVE-2023-3567: Linux Kernel Use-After-Free Vulnerability

CVE-2023-3567 Overview

CVE-2023-3567 is a use-after-free vulnerability in the vcs_read function within drivers/tty/vt/vc_screen.c in the Linux kernel's virtual console screen (vc_screen) subsystem. A local user with access to virtual console device nodes can trigger the flaw to crash the system or leak internal kernel memory contents. The issue is categorized under CWE-416: Use After Free and affects multiple enterprise Linux distributions including Red Hat Enterprise Linux 8 and 9, and Ubuntu LTS releases.

Critical Impact
Local attackers can cause kernel crashes (denial of service) or read sensitive kernel memory, potentially exposing credentials, pointers useful for bypassing KASLR, or other privileged data.

Affected Products

Linux Kernel (including 6.2.0 release candidates rc1 through rc6)
Red Hat Enterprise Linux 8.0 and 9.0
Canonical Ubuntu Linux 14.04 ESM, 16.04 ESM, 18.04 LTS, 20.04 LTS, and 22.04 LTS

Discovery Timeline

2023-07-24 - CVE-2023-3567 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-3567

Vulnerability Analysis

The vulnerability resides in the vcs_read handler that services read operations against /dev/vcs* and /dev/vcsa* virtual console device nodes. These nodes expose the contents of Linux virtual terminals to userspace. The vc_screen driver must coordinate access with concurrent virtual console operations such as console switching, resizing, and teardown.

During a read() call, vcs_read accesses struct vc_data representing the underlying console. If the console is freed by a concurrent operation while vcs_read still holds a reference to it, subsequent dereferences operate on memory that has been released back to the slab allocator. The result is either a kernel crash or disclosure of memory that has been reallocated for other purposes.

Root Cause

The root cause is insufficient lifetime management of the vc_data structure inside vcs_read. Locking and reference counting around the console object did not fully cover the read path, allowing a race where the structure is released between validation and use. This is a classic use-after-free pattern [CWE-416] caused by missing synchronization between the read path and console release.

Attack Vector

Exploitation requires local access and the ability to open a vcs or vcsa device node. An attacker races a read() against operations that destroy the underlying virtual console. Repeated triggering can be used to spray the slab and influence what data is read back from the freed object, enabling information disclosure of kernel memory. The same race can be used to corrupt kernel state and force a panic. The vulnerability does not provide a direct path to code execution based on the published advisory, but information leaks of this class are commonly chained with other primitives to defeat exploit mitigations.

No public proof-of-concept exploit is referenced in the NVD data, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The upstream fix is referenced in the Spinics stable-commits mailing list message.

Detection Methods for CVE-2023-3567

Indicators of Compromise

Unexpected kernel oops or panic messages in dmesg referencing vcs_read, vc_screen, or slab use-after-free reports from KASAN-enabled kernels.
Unprivileged processes repeatedly opening /dev/vcs* or /dev/vcsa* device nodes in tight read loops, which is atypical for normal workloads.
Local users performing rapid chvt, ioctl(VT_DISALLOCATE), or console resize operations concurrent with reads against virtual console devices.

Detection Strategies

Enable kernel runtime memory error detection (KASAN) on test systems to surface use-after-free conditions in drivers/tty/vt/vc_screen.c during fuzzing or QA.
Audit installed kernel package versions across the fleet against the vendor advisories below to identify hosts running vulnerable builds.
Monitor host telemetry for processes accessing /dev/vcs or /dev/vcsa outside expected administrative tooling such as getty, agetty, or screen-reader software.

Monitoring Recommendations

Forward kernel ring buffer events and auditd syscall traces to a centralized log platform and alert on kernel panics correlated with virtual console activity.
Track package inventory changes to confirm that kernel updates from the Red Hat or Ubuntu advisories are deployed on every affected host.
Restrict and log access to virtual console device nodes using SELinux or AppArmor policies, then alert on unexpected denials.

How to Mitigate CVE-2023-3567

Immediate Actions Required

Apply the kernel updates published by your distribution vendor; for Red Hat systems, install the kernel package versions described in advisories RHSA-2024:0412, RHSA-2024:0431, RHSA-2024:0432, RHSA-2024:0439, RHSA-2024:0448, RHSA-2024:0575, RHSA-2024:2394, RHSA-2024:2950, and RHSA-2024:3138.
For Ubuntu systems, apply kernel updates referenced in Kernel Live Patch Security Notice LSN-0098-1 and LSN-0099-1.
Reboot hosts after kernel updates, or use kernel live patching where available, to ensure the patched code path is active.
Restrict local access to multi-user systems and review which accounts can open virtual console devices.

Patch Information

The upstream fix is tracked in the stable tree commit announcement at the Spinics stable-commits message. Red Hat customers should consult the Red Hat CVE-2023-3567 page and Bugzilla #2221463 for package versions per RHEL stream. Multiple Red Hat errata address the issue, including RHSA-2024:0412, RHSA-2024:0575, and RHSA-2024:3138.

Workarounds

Where patching is not yet possible, restrict permissions on /dev/vcs* and /dev/vcsa* so only root and trusted system services can open them.
Limit the number of untrusted local users on affected hosts and prefer remote-only access models where virtual console exposure is minimized.
Apply mandatory access control policies (SELinux in enforcing mode or AppArmor) to confine processes that should not interact with virtual console devices.

bash

# Restrict access to virtual console screen devices until patches are applied
chmod 600 /dev/vcs* /dev/vcsa*
chown root:root /dev/vcs* /dev/vcsa*

# Verify the running kernel version after patching
uname -r
rpm -q kernel       # RHEL-based systems
dpkg -l | grep linux-image   # Debian/Ubuntu systems