CVE-2023-52772: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52772 is a use-after-free vulnerability discovered in the Linux kernel's af_unix module, specifically in the unix_stream_read_actor() function. The vulnerability was reported by syzbot and affects Linux kernel versions from 5.15 through 6.6.3. After releasing the unix socket lock, u->oob_skb can be changed by another thread, potentially leading to a use-after-free condition (NVD).

The vulnerability occurs in the net/unix/af_unix.c file when handling unix socket operations. After releasing the unix socket lock, the oob_skb pointer can be modified by another thread, leading to a use-after-free condition. The issue stems from improper reference counting of the skb (socket buffer) object. The CVSS v3.1 base score is 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability can lead to arbitrary code execution and kernel information leaks. It affects systems running vulnerable versions of the Linux kernel and requires local access with CAP_NET_ADMIN privileges to exploit (NVD).

The vulnerability requires local access and CAP_NET_ADMIN privileges to exploit. A proof-of-concept crash was reported by syzbot, demonstrating the use-after-free condition in the unix_stream_read_actor function (Kernel Patch).

The vulnerability has been fixed in Linux kernel versions 5.15.140, 6.1.64, 6.5.13, and 6.6.3. The fix involves properly managing the skb refcount by temporarily increasing it to ensure the other thread will not free the skb during access. Users should upgrade to the patched versions (ASEC).