Vulnerability · Published Dec 21, 2023 · Assigned by redhat

CVE-2023-6546Kernel: gsm multiplexing race condition leads to privilege escalation

High 7.0

In plain English

A high-severity security flaw in Red Hat Enterprise Linux 6 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.0High

Exploit odds (30 days)0.7%top 45.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem on a struct gsm_dlci while restarting the gsm mux. This could allow a local unprivileged user to escalate their privileges on the system.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
AlmaLinux:8	bpftool	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	bpftool	7.3.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-64k	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-64k-core	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-64k-debug	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-64k-debug-core	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-64k-debug-devel	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-64k-debug-devel-matched	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-64k-debug-modules	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-64k-debug-modules-core	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-64k-debug-modules-extra	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-64k-devel	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-64k-devel-matched	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-64k-modules	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-64k-modules-core	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-64k-modules-extra	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-abi-stablelists	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-abi-stablelists	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-core	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-core	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-cross-headers	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-cross-headers	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-debug	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-debug	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-debug-core	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-debug-core	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-debug-devel	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-debug-devel	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-debug-devel-matched	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-debug-modules	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-debug-modules	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-debug-modules-core	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-debug-modules-extra	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-debug-modules-extra	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-debug-uki-virt	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-devel	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-devel	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-devel-matched	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-doc	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-doc	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-headers	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-modules	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-modules	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-modules-core	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-modules-extra	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-modules-extra	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-rt	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-rt-core	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-rt-debug	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-rt-debug-core	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-rt-debug-devel	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-rt-debug-modules	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-rt-debug-modules-core	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-rt-debug-modules-extra	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-rt-devel	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-rt-modules	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-rt-modules-core	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-rt-modules-extra	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-tools	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-tools	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-tools-libs	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-tools-libs	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-tools-libs-devel	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-tools-libs-devel	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-uki-virt	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-zfcpdump	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-zfcpdump	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-zfcpdump-core	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-zfcpdump-core	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-zfcpdump-devel	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-zfcpdump-devel	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-zfcpdump-devel-matched	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-zfcpdump-modules	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-zfcpdump-modules	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	kernel-zfcpdump-modules-core	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	kernel-zfcpdump-modules-extra	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	kernel-zfcpdump-modules-extra	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	libperf	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	perf	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	perf	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:8	python3-perf	4.18.0-513.24.1.el8_9	ALSA-2024:1607
AlmaLinux:9	python3-perf	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	rtla	5.14.0-427.13.1.el9_4	ALSA-2024:2394
AlmaLinux:9	rv	5.14.0-427.13.1.el9_4	ALSA-2024:2394
Debian:12	linux	6.1.52-1	DEBIAN-CVE-2023-6546
Debian:13	linux	6.4.13-1	DEBIAN-CVE-2023-6546
Debian:14	linux	6.4.13-1	DEBIAN-CVE-2023-6546
Rocky Linux:8	kernel	0:4.18.0-513.24.1.el8_9.cloud.0.1	RXSA-2024:1607
Rocky Linux:8	kernel	0:4.18.0-513.24.1.el8_9	RLSA-2024:1607
Rocky Linux:8	kernel-rt	0:4.18.0-513.24.1.rt7.326.el8_9	RLSA-2024:1614
Ubuntu:22.04:LTS	linux	5.15.0-91.101	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-allwinner-5.19	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-aws	5.15.0-1051.56	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-aws-5.19	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-aws-6.2	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-azure	5.15.0-1053.61	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-azure-5.19	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-azure-6.2	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-azure-fde	5.15.0-1053.61.1	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-azure-fde-5.19	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-azure-fde-6.2	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-gcp	5.15.0-1048.56	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-gcp-5.19	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-gcp-6.2	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-gke	5.15.0-1048.53	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-gkeop	5.15.0-1034.40	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-hwe-5.19	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-hwe-6.2	6.2.0-39.40~22.04.1	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-ibm	5.15.0-1044.47	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-intel-iotg	5.15.0-1046.52	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-kvm	5.15.0-1048.53	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-lowlatency	5.15.0-91.101	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-lowlatency-hwe-5.19	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-lowlatency-hwe-6.2	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-nvidia	5.15.0-1042.42	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-nvidia-6.2	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-nvidia-tegra	5.15.0-1020.20	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-nvidia-tegra-igx	5.15.0-1007.7	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-oem-5.17	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-oem-6.0	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-oem-6.1	6.1.0-1023.23	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-oracle	5.15.0-1049.55	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-raspi	5.15.0-1044.47	UBUNTU-CVE-2023-6546
Ubuntu:24.04:LTS	linux-raspi-realtime	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-realtime	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-riscv	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-riscv-5.19	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-starfive-5.19	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-starfive-6.2	no fix listed	UBUNTU-CVE-2023-6546
Ubuntu:22.04:LTS	linux-xilinx-zynqmp	5.15.0-1027.31	UBUNTU-CVE-2023-6546

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8	see references
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	see references
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	see references
Red Hat	Red Hat Virtualization 4 for Red Hat Enterprise Linux 8	see references
Red Hat	RHOL-5.7-RHEL-8	see references
Red Hat	RHOL-5.7-RHEL-8	see references
Red Hat	RHOL-5.7-RHEL-8	see references
Red Hat	RHOL-5.7-RHEL-8	see references
Red Hat	RHOL-5.7-RHEL-8	see references
Red Hat	RHOL-5.7-RHEL-8	see references
Red Hat	RHOL-5.7-RHEL-8	see references
Red Hat	RHOL-5.7-RHEL-8	see references

Weakness: CWE-366 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

RHSA-2024:0930 vendor-advisory, x_refsource_REDHAT
RHSA-2024:0937 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1018 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1019 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1055 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1250 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1253 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1306 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1607 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1612 vendor-advisory, x_refsource_REDHAT
RHSA-2024:1614 vendor-advisory, x_refsource_REDHAT
RHSA-2024:2093 vendor-advisory, x_refsource_REDHAT
RHSA-2024:2394 vendor-advisory, x_refsource_REDHAT
RHSA-2024:2621 vendor-advisory, x_refsource_REDHAT
RHSA-2024:2697 vendor-advisory, x_refsource_REDHAT
RHSA-2024:4577 vendor-advisory, x_refsource_REDHAT
RHSA-2024:4729 vendor-advisory, x_refsource_REDHAT
RHSA-2024:4731 vendor-advisory, x_refsource_REDHAT
RHSA-2024:4970 vendor-advisory, x_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2023-6546 vdb-entry, x_refsource_REDHAT
RHBZ#2255498 issue-tracking, x_refsource_REDHAT
https://github.com/torvalds/linux/commit/3c4f8333b582487a2d1e02171f1465531cde53e3
https://www.zerodayinitiative.com/advisories/ZDI-CAN-20527
http://www.openwall.com/lists/oss-security/2024/04/10/18 x_transferred
http://www.openwall.com/lists/oss-security/2024/04/10/21 x_transferred
http://www.openwall.com/lists/oss-security/2024/04/11/7 x_transferred
http://www.openwall.com/lists/oss-security/2024/04/11/9 x_transferred
http://www.openwall.com/lists/oss-security/2024/04/12/1 x_transferred
http://www.openwall.com/lists/oss-security/2024/04/12/2 x_transferred
http://www.openwall.com/lists/oss-security/2024/04/16/2 x_transferred
http://www.openwall.com/lists/oss-security/2024/04/17/1 x_transferred