LiveActive security incident?Get immediate response
CVE Record

CVE-2023-54142: gtp: Fix use-after-free in __gtp_encap_destroy().

In the Linux kernel, the following vulnerability has been resolved: gtp: Fix use-after-free in __gtp_encap_destroy(). syzkaller reported use-after-free in __gtp_encap_destroy(). [0] It shows the same process freed sk and touched it illegally. Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock() and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data, but release_sock() is called after sock_put() releases the last refcnt. [0]: BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline] BUG: KASAN: slab-use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:111 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock include/linux/spinlock.h:186 [inline] BUG: KASAN: slab-use-after-free in __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline] BUG: KASAN: slab-use-after-free in _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178 Write of size 4 at addr ffff88800dbef398 by task syz-executor.2/2401 CPU: 1 PID: 2401 Comm: syz-executor.2 Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:351 [inline] print_report+0xcc/0x620 mm/kasan/report.c:462 kasan_report+0xb2/0xe0 mm/kasan/report.c:572 check_region_inline mm/kasan/generic.c:181 [inline] kasan_check_range+0x39/0x1c0 mm/kasan/generic.c:187 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline] queued_spin_lock include/asm-generic/qspinlock.h:111 [inline] do_raw_spin_lock include/linux/spinlock.h:186 [inline] __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline] _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:355 [inline] release_sock+0x1f/0x1a0 net/core/sock.c:3526 gtp_encap_disable_sock drivers/net/gtp.c:651 [inline] gtp_encap_disable+0xb9/0x220 drivers/net/gtp.c:664 gtp_dev_uninit+0x19/0x50 drivers/net/gtp.c:728 unregister_netdevice_many_notify+0x97e/0x1520 net/core/dev.c:10841 rtnl_delete_link net/core/rtnetlink.c:3216 [inline] rtnl_dellink+0x3c0/0xb30 net/core/rtnetlink.c:3268 rtnetlink_rcv_msg+0x450/0xb10 net/core/rtnetlink.c:6423 netlink_rcv_skb+0x15d/0x450 net/netlink/af_netlink.c:2548 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x700/0x930 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x91c/0xe30 net/netlink/af_netlink.c:1913 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0x1b7/0x200 net/socket.c:747 ____sys_sendmsg+0x75a/0x990 net/socket.c:2493 ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2547 __sys_sendmsg+0xfe/0x1d0 net/socket.c:2576 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f1168b1fe5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007f1167edccc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f1168b1fe5d RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f1168b80530 R15: 0000000000000000 </TASK> Allocated by task 1483: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x ---truncated---

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-54142 is a Linux kernel memory-safety bug in the GTP network driver. The public record shows a use-after-free found by syzkaller during GTP device teardown. Business urgency depends on whether affected kernels run with GTP functionality available or used.

Executive priority

Treat this as targeted kernel hygiene unless your environment uses Linux GTP networking. For GTP-dependent systems, prioritize vendor kernel updates because memory-safety faults in kernel networking can carry higher operational risk.

Technical view

The flaw is in __gtp_encap_destroy()/gtp_encap_disable. A previous locking change calls release_sock() after sock_put() may drop the last socket reference, causing later access to freed sk memory during GTP netdevice deletion.

Likely exposure

Exposure is most relevant for Linux systems running affected kernel versions with the GTP driver or GTP netdevices in use. The bundle does not provide CPEs, distribution package mappings, or configuration prerequisites beyond the Linux GTP code path.

Exploitation context

The source evidence is a syzkaller KASAN report, not observed exploitation. The CVE is not marked KEV. The bundle does not establish remote reachability, required privileges, practical exploitability, or impact beyond use-after-free behavior.

Researcher notes

The strongest evidence is the kernel commit narrative and syzkaller trace. The record lacks CVSS, CWE, exploit details, and distribution status. Avoid assuming exploitability; focus validation on kernel lineage and whether GTP teardown paths are reachable.

Mitigation direction

  • Inventory Linux kernel versions on systems that may use GTP networking.
  • Check vendor kernel advisories and distribution backports for CVE-2023-54142 coverage.
  • Apply kernel updates containing the listed stable fixes where applicable.
  • Prioritize hosts with GTP devices, GTP modules, or telecom packet-core roles.
  • If patch status is unclear, request vendor guidance for your exact kernel build.

Validation and detection

  • Confirm whether the running kernel includes a listed stable fix commit or vendor backport.
  • Check whether the gtp module is present, loaded, or built into the kernel.
  • Identify configured GTP netdevices on potentially exposed hosts.
  • Review kernel package changelogs for CVE-2023-54142 or the referenced commit titles.
  • Document systems where kernel lineage cannot be mapped to fixed builds.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2023-54142 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
10Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux01f3c64e405ab3d25887d080a103ad76f30661d2, e117a04133c673cc54292e12086a8177cd9bd4a4, e198987e7dd7d3645a53875151cd6f8fc425b706, e198987e7dd7d3645a53875151cd6f8fc425b706, e198987e7dd7d3645a53875151cd6f8fc425b706, e198987e7dd7d3645a53875151cd6f8fc425b706, e198987e7dd7d3645a53875151cd6f8fc425b706, e198987e7dd7d3645a53875151cd6f8fc425b706, e198987e7dd7d3645a53875151cd6f8fc425b706, bf75202df8e473d4ee914894542f213158066d8b, 76357f65f18f180f44ccbbbf713461881d0ab219, 4.14.135, 4.19.61, 5.1.20, 5.2.3unaffected
LinuxLinux5.3, 0, 4.14.322, 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4, 6.5affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.