CVE-2023-52483

Our current route lookups (mctproutelookup and mctproutelookup_null) traverse the net's route list without the RCU read lock held. This means the route lookup is subject to preemption, resulting in an potential grace period expiry, and so an eventual kfree() while we still have the route pointer.

Add the proper read-side critical section locks around the route lookups, preventing premption and a possible parallel kfree.

The remaining net->mctp.routes accesses are already under a rcureadlock, or protected by the RTNL for updates.

Based on an analysis from Sili Luo rootlab@huawei.com, where introducing a delay in the route lookup could cause a UAF on simultaneous sendmsg() and route deletion.

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52483.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

889b7da23abf92faf34491df95733bda63639e32

Fixed

6c52b12159049046483fdb0c411a0a1869c41a67

Fixed

1db0724a01b558feb1ecae551782add1951a114a

Fixed

2405f64a95a7a094eb24cba9bcfaffd1ea264de4

Fixed

5093bbfc10ab6636b32728e35813cbd79feb063c

Affected versions

v5.*

v5.14

v5.14-rc3

v5.14-rc4

v5.14-rc5

v5.14-rc6

v5.14-rc7

v5.15

v5.15-rc1

v5.15-rc2

v5.15-rc3

v5.15-rc4

v5.15-rc5

v5.15-rc6

v5.15-rc7

v5.15.1

v5.15.10

v5.15.100

v5.15.101

v5.15.102

v5.15.103

v5.15.104

v5.15.105

v5.15.106

v5.15.107

v5.15.108

v5.15.109

v5.15.11

v5.15.110

v5.15.111

v5.15.112

v5.15.113

v5.15.114

v5.15.115

v5.15.116

v5.15.117

v5.15.118

v5.15.119

v5.15.12

v5.15.120

v5.15.121

v5.15.122

v5.15.123

v5.15.124

v5.15.125

v5.15.126

v5.15.127

v5.15.128

v5.15.129

v5.15.13

v5.15.130

v5.15.131

v5.15.132

v5.15.133

v5.15.134

v5.15.135

v5.15.136

v5.15.14

v5.15.15

v5.15.16

v5.15.17

v5.15.18

v5.15.19

v5.15.2

v5.15.20

v5.15.21

v5.15.22

v5.15.23

v5.15.24

v5.15.25

v5.15.26

v5.15.27

v5.15.28

v5.15.29

v5.15.3

v5.15.30

v5.15.31

v5.15.32

v5.15.33

v5.15.34

v5.15.35

v5.15.36

v5.15.37

v5.15.38

v5.15.39

v5.15.4

v5.15.40

v5.15.41

v5.15.42

v5.15.43

v5.15.44

v5.15.45

v5.15.46

v5.15.47

v5.15.48

v5.15.49

v5.15.5

v5.15.50

v5.15.51

v5.15.52

v5.15.53

v5.15.54

v5.15.55

v5.15.56

v5.15.57

v5.15.58

v5.15.59

v5.15.6

v5.15.60

v5.15.61

v5.15.62

v5.15.63

v5.15.64

v5.15.65

v5.15.66

v5.15.67

v5.15.68

v5.15.69

v5.15.7

v5.15.70

v5.15.71

v5.15.72

v5.15.73

v5.15.74

v5.15.75

v5.15.76

v5.15.77

v5.15.78

v5.15.79

v5.15.8

v5.15.80

v5.15.81

v5.15.82

v5.15.83

v5.15.84

v5.15.85

v5.15.86

v5.15.87

v5.15.88

v5.15.89

v5.15.9

v5.15.90

v5.15.91

v5.15.92

v5.15.93

v5.15.94

v5.15.95

v5.15.96

v5.15.97

v5.15.98

v5.15.99

v5.16

v5.16-rc1

v5.16-rc2

v5.16-rc3

v5.16-rc4

v5.16-rc5

v5.16-rc6

v5.16-rc7

v5.16-rc8

v5.17

v5.17-rc1

v5.17-rc2

v5.17-rc3

v5.17-rc4

v5.17-rc5

v5.17-rc6

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.1.1

v6.1.10

v6.1.11

v6.1.12

v6.1.13

v6.1.14

v6.1.15

v6.1.16

v6.1.17

v6.1.18

v6.1.19

v6.1.2

v6.1.20

v6.1.21

v6.1.22

v6.1.23

v6.1.24

v6.1.25

v6.1.26

v6.1.27

v6.1.28

v6.1.29

v6.1.3

v6.1.30

v6.1.31

v6.1.32

v6.1.33

v6.1.34

v6.1.35

v6.1.36

v6.1.37

v6.1.38

v6.1.39

v6.1.4

v6.1.40

v6.1.41

v6.1.42

v6.1.43

v6.1.44

v6.1.45

v6.1.46

v6.1.47

v6.1.48

v6.1.49

v6.1.5

v6.1.50

v6.1.51

v6.1.52

v6.1.53

v6.1.54

v6.1.55

v6.1.56

v6.1.57

v6.1.58

v6.1.6

v6.1.7

v6.1.8

v6.1.9

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.5

v6.5-rc1

v6.5-rc2

v6.5-rc3

v6.5-rc4

v6.5-rc5

v6.5-rc6

v6.5-rc7

v6.5.1

v6.5.2

v6.5.3

v6.5.4

v6.5.5

v6.5.6

v6.5.7

v6.6-rc1

v6.6-rc2

v6.6-rc3

v6.6-rc4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52483.json"

vanir_signatures

[
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2405f64a95a7a094eb24cba9bcfaffd1ea264de4",
        "digest": {
            "line_hashes": [
                "319241742137069264576581532881717038982",
                "251618877283018076881250143562233657748",
                "21843233341862178698845629919554207509",
                "235238356107683688066465281475807181152",
                "90244672383340133909303174591705869257",
                "254228963247510035795847090453795387994",
                "185796816662969235243937745258608216572",
                "112996617361912380005899543385909653988",
                "207838609862800270129626389485621635619",
                "130660352681662770837444682651148076322",
                "235759299618597706711215849978526961184",
                "64304881312695349836782171335746720427",
                "66185656926366782577416299570001645683",
                "308188003619414462492976403610051620360",
                "163163694860360546061182020137678246340",
                "181663156205076706358638634259886640064",
                "247045047711916184980262989361512393878",
                "217736672245552424495163360119337357286"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2023-52483-131b812d",
        "deprecated": false,
        "target": {
            "file": "net/mctp/route.c"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5093bbfc10ab6636b32728e35813cbd79feb063c",
        "digest": {
            "function_hash": "246211044837981703720620395301356640511",
            "length": 268.0
        },
        "id": "CVE-2023-52483-44bd5400",
        "deprecated": false,
        "target": {
            "file": "net/mctp/route.c",
            "function": "mctp_route_lookup_null"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1db0724a01b558feb1ecae551782add1951a114a",
        "digest": {
            "line_hashes": [
                "319241742137069264576581532881717038982",
                "251618877283018076881250143562233657748",
                "21843233341862178698845629919554207509",
                "235238356107683688066465281475807181152",
                "90244672383340133909303174591705869257",
                "254228963247510035795847090453795387994",
                "185796816662969235243937745258608216572",
                "112996617361912380005899543385909653988",
                "207838609862800270129626389485621635619",
                "130660352681662770837444682651148076322",
                "235759299618597706711215849978526961184",
                "64304881312695349836782171335746720427",
                "66185656926366782577416299570001645683",
                "308188003619414462492976403610051620360",
                "163163694860360546061182020137678246340",
                "181663156205076706358638634259886640064",
                "247045047711916184980262989361512393878",
                "217736672245552424495163360119337357286"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2023-52483-54d1e699",
        "deprecated": false,
        "target": {
            "file": "net/mctp/route.c"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c52b12159049046483fdb0c411a0a1869c41a67",
        "digest": {
            "line_hashes": [
                "319241742137069264576581532881717038982",
                "251618877283018076881250143562233657748",
                "21843233341862178698845629919554207509",
                "235238356107683688066465281475807181152",
                "90244672383340133909303174591705869257",
                "254228963247510035795847090453795387994",
                "185796816662969235243937745258608216572",
                "112996617361912380005899543385909653988",
                "207838609862800270129626389485621635619",
                "130660352681662770837444682651148076322",
                "235759299618597706711215849978526961184",
                "64304881312695349836782171335746720427",
                "66185656926366782577416299570001645683",
                "308188003619414462492976403610051620360",
                "163163694860360546061182020137678246340",
                "181663156205076706358638634259886640064",
                "178298973326340313877173240752715774346",
                "314440271408598374328844565127282173614"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2023-52483-5bd0ba76",
        "deprecated": false,
        "target": {
            "file": "net/mctp/route.c"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c52b12159049046483fdb0c411a0a1869c41a67",
        "digest": {
            "function_hash": "95572639483201775649748078667996135560",
            "length": 289.0
        },
        "id": "CVE-2023-52483-5e09c816",
        "deprecated": false,
        "target": {
            "file": "net/mctp/route.c",
            "function": "mctp_route_lookup"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5093bbfc10ab6636b32728e35813cbd79feb063c",
        "digest": {
            "function_hash": "95572639483201775649748078667996135560",
            "length": 289.0
        },
        "id": "CVE-2023-52483-66feee62",
        "deprecated": false,
        "target": {
            "file": "net/mctp/route.c",
            "function": "mctp_route_lookup"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1db0724a01b558feb1ecae551782add1951a114a",
        "digest": {
            "function_hash": "246211044837981703720620395301356640511",
            "length": 268.0
        },
        "id": "CVE-2023-52483-701496eb",
        "deprecated": false,
        "target": {
            "file": "net/mctp/route.c",
            "function": "mctp_route_lookup_null"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c52b12159049046483fdb0c411a0a1869c41a67",
        "digest": {
            "function_hash": "246211044837981703720620395301356640511",
            "length": 268.0
        },
        "id": "CVE-2023-52483-b85b1236",
        "deprecated": false,
        "target": {
            "file": "net/mctp/route.c",
            "function": "mctp_route_lookup_null"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2405f64a95a7a094eb24cba9bcfaffd1ea264de4",
        "digest": {
            "function_hash": "95572639483201775649748078667996135560",
            "length": 289.0
        },
        "id": "CVE-2023-52483-b89db5b4",
        "deprecated": false,
        "target": {
            "file": "net/mctp/route.c",
            "function": "mctp_route_lookup"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2405f64a95a7a094eb24cba9bcfaffd1ea264de4",
        "digest": {
            "function_hash": "246211044837981703720620395301356640511",
            "length": 268.0
        },
        "id": "CVE-2023-52483-bc079c69",
        "deprecated": false,
        "target": {
            "file": "net/mctp/route.c",
            "function": "mctp_route_lookup_null"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1db0724a01b558feb1ecae551782add1951a114a",
        "digest": {
            "function_hash": "95572639483201775649748078667996135560",
            "length": 289.0
        },
        "id": "CVE-2023-52483-cc7fd63c",
        "deprecated": false,
        "target": {
            "file": "net/mctp/route.c",
            "function": "mctp_route_lookup"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5093bbfc10ab6636b32728e35813cbd79feb063c",
        "digest": {
            "line_hashes": [
                "319241742137069264576581532881717038982",
                "251618877283018076881250143562233657748",
                "21843233341862178698845629919554207509",
                "235238356107683688066465281475807181152",
                "90244672383340133909303174591705869257",
                "254228963247510035795847090453795387994",
                "185796816662969235243937745258608216572",
                "112996617361912380005899543385909653988",
                "207838609862800270129626389485621635619",
                "130660352681662770837444682651148076322",
                "235759299618597706711215849978526961184",
                "64304881312695349836782171335746720427",
                "66185656926366782577416299570001645683",
                "308188003619414462492976403610051620360",
                "163163694860360546061182020137678246340",
                "181663156205076706358638634259886640064",
                "247045047711916184980262989361512393878",
                "217736672245552424495163360119337357286"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2023-52483-f2da451d",
        "deprecated": false,
        "target": {
            "file": "net/mctp/route.c"
        }
    }
]

Git / github.com/gregkh/linux