Intel

CVE-2023-0266

:linux_kernel:: Use After Free (CVE-2023-0266)

criticalKEV: actively exploitedPoCEPSS 3.7%

Description

A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e

Source: BSIBSI_CSAFCVELISTV5OSVCISA_KEVNVDCVEORG

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2023-0266 allows a local attacker with low privileges to trigger a race condition in the ALSA PCM subsystem, causing a use-after-free that yields full ring-0 (kernel) control. The CVSS vector AV:L/AC:H/PR:L/UI:N reflects the high attack complexity, but that complexity is substantially reduced by publicly available proof-of-concept exploit code. An EPSS score at the 89th percentile confirms that this vulnerability sees significantly more exploitation activity than the vast majority of published CVEs. Environments most at risk are those where untrusted or semi-trusted users have local access to Linux hosts — shared hosting, CI/CD runners, enterprise Android fleets, and multi-tenant Kubernetes clusters. For NIS2-scoped organisations, a successful exploit means complete system compromise with the ability to establish kernel-level persistence and move laterally, making this a high-priority patch target regardless of the absence of a known ransomware campaign flag.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the upstream kernel fix: the authoritative patch is commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e — update distribution packages immediately (linux-image-* on Debian/Ubuntu, kernel-* on RHEL/CentOS); verify the exact patched version in your vendor's security advisory.
  • Android devices: apply the Google Android Security Bulletin patch for March 2023 or later; devices without an available OEM patch should be isolated or removed from production until a patch is available.
  • Restrict local access to affected systems: limit SSH and console logins to the minimum set of privileged administrators; disable or lock unprivileged user accounts on exposed hosts until patched.
  • Disable the ALSA kernel module as a temporary workaround (only where audio is not required): echo 'install snd /bin/false' >> /etc/modprobe.d/disable-snd.conf && modprobe -r snd — note this breaks audio functionality and is suitable only for servers or embedded systems.
  • Triage exposed hosts: review dmesg and /var/log/kern.log on all at-risk Linux systems for ALSA-related errors, kernel panics, or KASAN traces; isolate any host showing anomalies immediately.

Runbook · Step 2

Mitigation layers

  • Least privilege / access control: Remove world-read/write permissions on ALSA device nodes (chmod o-rw /dev/snd/*) via udev rules or filesystem ACLs; tighten AppArmor or SELinux profiles for any service that does not require ALSA access.
  • Kernel hardening: Enable CONFIG_SECURITY_LOCKDOWN_LSM if supported by the running kernel build; set kernel.dmesg_restrict=1 and kernel.perf_event_paranoid=3 via sysctl to raise the bar for post-exploitation reconnaissance.
  • Container and namespace isolation: Run containerised workloads with --cap-drop=ALL and without SYS_ADMIN; apply seccomp profiles that block ioctl calls targeting /dev/snd device paths to prevent exploitation from within containers.
  • Endpoint detection: Deploy Falco or Wazuh with rules targeting unexpected privilege escalation patterns and kernel module loads; configure auditd to watch ioctl calls on ALSA control devices (see Detection rules below).
  • Network segmentation: Move unpatched hosts into a restricted VLAN with outbound connections limited to known management destinations, reducing the blast radius of any successful post-exploitation C2 activity.

Runbook · Step 3

Detection rules

  • auditd — ALSA ioctl monitoring: 
    -a always,exit -F arch=b64 -S ioctl -F path=/dev/snd/controlC0 -k alsa_ioctl_watch
    Alert on ioctl numbers 0xc0045520 (SNDRV_CTL_IOCTL_ELEM_READ32) and 0xc0045521 (WRITE32) issued by unexpected processes or users.
  • Sysmon for Linux (EID 1 / EID 11): Detect unusual parent-child process chains following ALSA ioctl activity — specifically a non-root process spawning a child with euid=0 without a preceding sudo/su event.
  • dmesg / kern.log — UAF and KASAN traces: Monitor for strings use-after-free, KASAN, BUG: KASAN: use-after-free in snd_ctl_elem_read; Sigma shape: 
    detection:
  keywords: ['use-after-free', 'snd_ctl_elem', 'KASAN']
logsource: { product: linux, service: kernel }
  • Falco rule: Alert when a process transitions from euid!=0 to euid=0 without a legitimate sudo/su ancestor, particularly when the process has previously opened a file matching /dev/snd/controlC*.
  • Network telemetry (Zeek/Suricata): Correlate outbound connections from a host to unknown external IPs within 60 seconds of an auditd ALSA ioctl event — this pattern may indicate post-exploitation C2 beacon activity.

Metrics

Severity
critical
Priority score
195.31
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
7.9
Source: cna-v3
CVSS v3
7.9
CVSS v4
—
EPSS percentile
89.1 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
3.7 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2023-01-30 13:09 UTC
CWE
CWE-416

Weakness classes (CWE)

  • CWE-416Variant

    Use After Free

    The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

    cwe.mitre.org →

Affected operating systems

  • linux

    debian / debian_linux10.0

  • linux

    linux / linux_kernel

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • android

    :linux_kernel::0

  • android

    :linux_kernel:Kernel

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2023-0266