CyberRota Analysis
AI-GeneratedThe vulnerability arises in the RACK setsockopt(2) handler, which improperly manages connection locks during the copying of option data from userspace, potentially leading to a use-after-free condition. This flaw could allow an unprivileged local user to escalate their privileges by exploiting the race condition created when userspace switches TCP stacks. Organizations utilizing affected products should prioritize remediation to mitigate the risk of privilege escalation attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The RACK setsockopt(2) handler drops the connection lock in order to copy option data from userspace, then reacquires the lock. After reacquiring, it verifies that the TCP stack had not been switched away, but did not reload its pointer to the stack's per-connection control block. If userspace switches stacks twice during this window, the check will succeed but the saved pointer will refer to freed memory. The bug may be exploitable by an unprivileged local user to escalate privileges.
Related CVEs
Other vulnerabilities affecting the same vendor(s)