Skip to content
Heist/ feed
Critical

net: prevent skb corruption on frag list segmentation

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: net: prevent skb corruption on frag list segmentation Ian reported several skb corruptions triggered by rx-gro-list, collecting different oops alike: [ 62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0 [ 62.631083] #PF: supervisor read access in kernel mode [ 62.636312] #PF: error_code(0x0000) - not-present page [ 62.641541] PGD 0 P4D 0 [ 62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364 [ 62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022 [ 62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858 ./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261 net/ipv4/udp_offload.c:277) [ 62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246 [ 62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000 [ 62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4 [ 62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9 [ 62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2 [ 62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9 [ 62.728654] FS: 0000000000000000(0000) GS:ffffa127efa40000(0000) knlGS:0000000000000000 [ 62.736852] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0

Announced Source revision 1
Original source ↗

CVE-2023-54094

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2023-54094

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
        "lessThan": "bc3ab5d2ab69823f5cff89cf74ef78ffa0386c9a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
        "lessThan": "ea438eed94ac0fe69b93ac034738823c0e989a12",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
        "lessThan": "1731234e8b60063eae858c77b55c7a88f5084353",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
        "lessThan": "7a59f29961cf97b98b02acaadf5a0b1f8dde938c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596",
        "lessThan": "c329b261afe71197d9da83c1f18eb45a7e97e089",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/core/skbuff.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.6"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.6",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.188",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.121",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.40",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.4.5",
        "versionType": "semver",
        "lessThanOrEqual": "6.4.*"
      },
      {
        "status": "unaffected",
        "version": "6.5",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/core/skbuff.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2023-54094

Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event
#30345 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement