CVE-2023-53559

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix potential slab-use-after-free in decode_session6 When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ip_vti device sends IPv6 packets. As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= f855691975bb06373a98711e4cfe2c224244b536 < 82fb41c5de243e7dfa90f32ca58e35adaff56c1d, >= f855691975bb06373a98711e4cfe2c224244b536 < 7dfe23659f3677c08a60a0056cda2d91a79c15ca, >= f855691975bb06373a98711e4cfe2c224244b536 < d34c30442d5e53a33cde79ca163320dbe2432cbd, >= f855691975bb06373a98711e4cfe2c224244b536 < 0b4d69539fdea138af2befe08893850c89248068, >= f855691975bb06373a98711e4cfe2c224244b536 < e1e04cc2ef2c0c0866c19f5627149a76c2baae32, >= f855691975bb06373a98711e4cfe2c224244b536 < 2b05bf5dc437f7891dd409a3eaf5058459391c7a, >= f855691975bb06373a98711e4cfe2c224244b536 < 78e397a43e1c47321a4679cc49a6c4530bf820b9, >= f855691975bb06373a98711e4cfe2c224244b536 < 6018a266279b1a75143c7c0804dd08a5fc4c3e0b, >= 3.19, >= 3.19.1 < 4.14.324, >= 4.15 < 4.19.293, >= 4.20 < 5.4.255, >= 5.5 < 5.10.192, >= 5.11 < 5.15.128, >= 5.16 < 6.1.47, >= 6.2 < 6.4.12, 3.19, 6.5

Fixed versions

4.14.324, 4.19.293, 5.4.255, 5.10.192, 5.15.128, 6.1.47, 6.4.12

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416