CVE-2023-6531 Overview
CVE-2023-6531 is a use-after-free flaw in the Linux kernel's Unix domain socket garbage collector. The vulnerability stems from a race condition between the garbage collector's deletion of a socket buffer (SKB) and concurrent execution of unix_stream_read_generic() on the socket where the SKB is queued. A local authenticated attacker can trigger the race to access freed kernel memory. Successful exploitation can lead to kernel memory corruption, privilege escalation, or denial of service. The flaw affects mainline Linux kernel versions through 6.7-rc4 and Red Hat Enterprise Linux 9.
Critical Impact
Local attackers with low privileges can corrupt kernel memory and potentially escalate to root through a race condition in Unix socket SKB handling.
Affected Products
- Linux Kernel (versions through 6.7-rc4)
- Red Hat Enterprise Linux 9.0
- Debian LTS distributions shipping affected kernel builds
Discovery Timeline
- 2024-01-21 - CVE-2023-6531 published to NVD
- 2024-01 - Debian LTS security announcement issued
- RHSA-2024:2394 - Red Hat releases security errata for affected RHEL 9 kernels
- 2025-11-04 - Last updated in NVD database
Technical Details for CVE-2023-6531
Vulnerability Analysis
The flaw resides in the Linux kernel's AF_UNIX socket subsystem, specifically in the interaction between the Unix garbage collector and the stream read path. Unix domain sockets can transfer file descriptors between processes using SCM_RIGHTS ancillary messages. The kernel runs a dedicated garbage collector to reclaim sockets trapped in reference cycles created by these descriptor passes.
When the garbage collector unlinks an SKB queued on a socket, it does not adequately synchronize with unix_stream_read_generic(), which may be reading from the same queue on another CPU. The reader can dereference an SKB that the collector has already freed, producing a classic use-after-free condition tracked under [CWE-362].
Root Cause
The root cause is missing synchronization in the Unix garbage collector when removing queued SKBs from sockets that may simultaneously be drained by readers. The garbage collector assumed exclusive access to queued SKBs during cleanup, but unix_stream_read_generic() operates on the same sk_receive_queue without holding a lock compatible with the collector's deletion path.
Attack Vector
Exploitation requires local access and a low-privileged account capable of creating Unix domain sockets and passing file descriptors via SCM_RIGHTS. An attacker constructs reference cycles between Unix sockets to force garbage collection, then races a reader thread against the collector to access freed SKB memory. The high attack complexity reflects the precise timing required to win the race.
No verified public exploit code is provided in the referenced data; the vulnerability mechanism is described in the kernel mailing list discussion linked in the Kernel Mailing List Discussion and the Packet Storm Exploit Release.
Detection Methods for CVE-2023-6531
Indicators of Compromise
- Unexpected kernel oops or panic entries in dmesg referencing unix_gc, unix_stream_read_generic, or skb_unlink.
- Processes invoking heavy SCM_RIGHTS file descriptor passing between unrelated Unix sockets.
- Local accounts spawning tight loops of socketpair(AF_UNIX, SOCK_STREAM) followed by sendmsg() with cmsg payloads carrying socket FDs.
Detection Strategies
- Audit kernel logs for KASAN or use-after-free warnings naming the Unix socket subsystem.
- Monitor auditd for unusual rates of sendmsg syscalls carrying SCM_RIGHTS from non-administrative users.
- Track unexpected SUID execution or capability changes shortly after intensive Unix socket activity.
Monitoring Recommendations
- Enable kernel address sanitizers and lockdep on test fleets to surface race conditions before production exposure.
- Forward dmesg and auditd events to a centralized log pipeline for correlation with privilege escalation indicators.
- Establish a baseline of legitimate Unix socket FD passing per host and alert on statistical deviations.
How to Mitigate CVE-2023-6531
Immediate Actions Required
- Apply the kernel updates shipped in RHSA-2024:2394 for Red Hat Enterprise Linux 9 hosts.
- Update Debian systems using the fixes announced in the Debian LTS Security Announcement.
- Inventory all hosts running affected kernels and prioritize multi-tenant systems, container hosts, and shared development environments.
Patch Information
The upstream fix is discussed on the kernel mailing list at the Kernel Mailing List Discussion. Red Hat tracks remediation under Red Hat CVE Details and ships fixed kernels through RHSA-2024:2394. Reboot affected hosts after package installation so the patched kernel is loaded.
Workarounds
- Restrict local shell access on multi-tenant systems until patched kernels are deployed.
- Apply seccomp or AppArmor profiles to untrusted workloads to block or limit sendmsg() with SCM_RIGHTS cmsg payloads.
- Run sensitive workloads inside hardened containers with user namespaces and minimal capabilities to reduce blast radius if the race is won.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
