xfrm: fix slab-use-after-free in decode_session6
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix slab-use-after-free in decode_session6 When the xfrm device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when the xfrm device sends IPv6 packets. The stack information is as follows: BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff8881111458ef by task swapper/3/0 CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.4.0-next-20230707 #409 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 xfrmi_xmit+0x173/0x1ca0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0 asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:intel_idle_hlt+0x23/0x30 Code: 1f 84 00 00 00 00 00 f3 0f 1e fa 41 54 41 89 d4 0f 1f 44 00 00 66 90 0f 1f 44 00 00 0f 00 2d c4 9f a
CVE-2023-53500
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-53500
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"lessThan": "da4cbaa75ed088b6d70db77b9103a27e2359e243",
"versionType": "git"
},
{
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"lessThan": "db0e50741f0387f388e9ec824ea7ae8456554d5b",
"versionType": "git"
},
{
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"lessThan": "bafa236380816b41b2c4c6970d9067fefa4a6c9e",
"versionType": "git"
},
{
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"lessThan": "44b3d40967009304617a7a6486490c1d6c12f899",
"versionType": "git"
},
{
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"lessThan": "0d27567fde5be5f0edc2db5c110142b7915b8fa8",
"versionType": "git"
},
{
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"lessThan": "86f15300a22656db3fa8c8967defbcd24fac4d37",
"versionType": "git"
},
{
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"lessThan": "53223f2ed1ef5c90dad814daaaefea4e68a933c8",
"versionType": "git"
}
],
"programFiles": [
"net/xfrm/xfrm_interface_core.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.19",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "4.19.293",
"versionType": "semver",
"lessThanOrEqual": "4.19.*"
},
{
"status": "unaffected",
"version": "5.4.255",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.192",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.128",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.47",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.4.12",
"versionType": "semver",
"lessThanOrEqual": "6.4.*"
},
{
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/xfrm/xfrm_interface_core.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2023-53500
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30278 · Revision 1
- Added to Heist Feed
- Publisher date