tcp: fix skb_copy_ubufs() vs BIG TCP
In the Linux kernel, the following vulnerability has been resolved: tcp: fix skb_copy_ubufs() vs BIG TCP David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy using hugepages, and skb length bigger than ~68 KB. skb_copy_ubufs() assumed it could copy all payload using up to MAX_SKB_FRAGS order-0 pages. This assumption broke when BIG TCP was able to put up to 512 KB per skb. We did not hit this bug at Google because we use CONFIG_MAX_SKB_FRAGS=45 and limit gso_max_size to 180000. A solution is to use higher order pages if needed. v2: add missing __GFP_COMP, or we leak memory.
CVE-2023-53669
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-53669
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7c4e983c4f3cf94fcd879730c6caa877e0768a4d",
"lessThan": "7fa93e39fbb0566019c388a8038a4d58552e0910",
"versionType": "git"
},
{
"status": "affected",
"version": "7c4e983c4f3cf94fcd879730c6caa877e0768a4d",
"lessThan": "3c77a377877acbaf03cd7caa21d3644a5dd16301",
"versionType": "git"
},
{
"status": "affected",
"version": "7c4e983c4f3cf94fcd879730c6caa877e0768a4d",
"lessThan": "9cd62f0ba465cf647c7d8c2ca7b0d99ea0c1328f",
"versionType": "git"
},
{
"status": "affected",
"version": "7c4e983c4f3cf94fcd879730c6caa877e0768a4d",
"lessThan": "7e692df3933628d974acb9f5b334d2b3e885e2a6",
"versionType": "git"
}
],
"programFiles": [
"net/core/skbuff.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.19",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.29",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.2.16",
"versionType": "semver",
"lessThanOrEqual": "6.2.*"
},
{
"status": "unaffected",
"version": "6.3.3",
"versionType": "semver",
"lessThanOrEqual": "6.3.*"
},
{
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/core/skbuff.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2023-53669
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30301 · Revision 1
- Added to Heist Feed
- Publisher date