tunnels: fix kasan splat when generating ipv4 pmtu error
In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp error in response to a nonliner skb, we get BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 Read of size 4 at addr ffff88811c50db00 by task iperf3/1691 CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309 [..] kasan_report+0x105/0x140 ip_compute_csum+0x134/0x220 iptunnel_pmtud_build_icmp+0x554/0x1020 skb_tunnel_check_pmtu+0x513/0xb80 vxlan_xmit_one+0x139e/0x2ef0 vxlan_xmit+0x1867/0x2760 dev_hard_start_xmit+0x1ee/0x4f0 br_dev_queue_push_xmit+0x4d1/0x660 [..] ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck.
CVE-2023-53600
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-53600
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"lessThan": "5850c391fd7e25662334cb3cbf29a62bcbff1084",
"versionType": "git"
},
{
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"lessThan": "e95808121953410db8c59f0abfde70ac0d34222c",
"versionType": "git"
},
{
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"lessThan": "da5f42a6e7485fbb7a6dbd6a2b3045e19e4df5cc",
"versionType": "git"
},
{
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"lessThan": "fe6a9f7516735be9fdabab00e47ef7a3403a174d",
"versionType": "git"
},
{
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"lessThan": "6a7ac3d20593865209dceb554d8b3f094c6bd940",
"versionType": "git"
}
],
"programFiles": [
"net/ipv4/ip_tunnel_core.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.191",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.127",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.46",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.4.11",
"versionType": "semver",
"lessThanOrEqual": "6.4.*"
},
{
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ipv4/ip_tunnel_core.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2023-53600
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #30291 · Revision 1
- Added to Heist Feed
- Publisher date