xsk: Fix xsk_diag use-after-free error during socket cleanup (Linux Linux)

CVE-2023-53426
HIGH 7.8

At a glance

Source
NVD
EPSS
EPSS 0.15 % · percentile 5 ()
State
PUBLISHED
Published
Updated
Assigner
Linux
NVD status
Modified

Description

In the Linux kernel, the following vulnerability has been resolved: xsk: Fix xsk_diag use-after-free error during socket cleanup Fix a use-after-free error that is possible if the xsk_diag interface is used after the socket has been unbound from the device. This can happen either due to the socket being closed or the device disappearing. In the early days of AF_XDP, the way we tested that a socket was not bound to a device was to simply check if the netdevice pointer in the xsk socket structure was NULL. Later, a better system was introduced by having an explicit state variable in the xsk socket struct. For example, the state of a socket that is on the way to being closed and has been unbound from the device is XSK_UNBOUND. The commit in the Fixes tag below deleted the old way of signalling that a socket is unbound, setting dev to NULL. This in the belief that all code using the old way had been exterminated. That was unfortunately not true as the xsk diagnostics code was still using the old way and thus does not work as intended when a socket is going down. Fix this by introducing a test against the state variable. If the socket is in the state XSK_UNBOUND, simply abort the diagnostic's netlink operation.

Weaknesses (CWE)

References

Scores

VersionScoreVectorScored by
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCISA-ADP
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · nvd@nist.gov (Primary)
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

European references

CERT-FR advisories

Affected configurations (NVD CPE)

Affected products

ProductVersions
Linux · Linuxaffected ad7219cd8751bd258b9d1e69ae0654ec00f71875 < 5979985f2d6b565b6cf0f79a62670a2855c0e96c ; affected 18b1ab7aa76bde181bdb1ab19a87fa9523c32f21 < 6436973164ea5506a495f39e56be5aea375e7832 ; affected 18b1ab7aa76bde181bdb1ab19a87fa9523c32f21 < 595931912357fa3507e522a7f8a0a76e423c23e4 ; affected 18b1ab7aa76bde181bdb1ab19a87fa9523c32f21 < 3e019d8a05a38abb5c85d4f1e85fda964610aa14 ; affected d1579253ffce39986e7a6ab757ac93b2680a665f ; affected 8a2dea162b92c322f3e42eae0c4a74b8d20aa7a9
Linux · Linuxaffected 5.18 ; unaffected 0 < 5.18 ; unaffected 5.15.132 ≤ 5.15.* ; unaffected 6.1.54 ≤ 6.1.* ; unaffected 6.5.4 ≤ 6.5.* ; unaffected 6.6 ≤ *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD