CVE-2023-4194: Kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid

Vulnerability summary

CVE-2023-4194 is a medium (CVSS 5.5) vulnerability in debian debian_linux. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.9% of scored vulnerabilities.

Timeline

1. 07-08-2023
   PublishedVulnerability first disclosed.
2. 03-11-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is that the following upstream commits - a096ccca6e50 ("tun: tun_chr_open(): correctly initialize socket uid"), - 66b2c338adce ("tap: tap_open(): correctly initialize socket uid"), pass "inode->i_uid" to sock_init_data_uid() as the last parameter and that turns out to not be accurate.

• CWE-843Access of Resource Using Incompatible TypeThe product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.