CVE-2023-52487

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-52487
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52487.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-52487
Downstream
Related
Published
2024-02-29T15:52:07Z
Modified
2025-10-15T03:13:40.723495Z
Summary
net/mlx5e: Fix peer flow lists handling
Details

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: Fix peer flow lists handling

The cited change refactored mlx5etcdelfdbpeerflow() to only clear DUP flag when list of peer flows has become empty. However, if any concurrent user holds a reference to a peer flow (for example, the neighbor update workqueue task is updating peer flow's parent encap entry concurrently), then the flow will not be removed from the peer list and, consecutively, DUP flag will remain set. Since mlx5etcdelfdbpeersflow() calls mlx5etcdelfdbpeerflow() for every possible peer index the algorithm will try to remove the flow from eswitch instances that it has never peered with causing either NULL pointer dereference when trying to remove the flow peer list head of peerindex that was never initialized or a warning if the list debug config is enabled[0].

Fix the issue by always removing the peer flow from the list even when not releasing the last reference to it.

[0]:

[ 3102.985806] ------------[ cut here ]------------ [ 3102.986223] listdel corruption, ffff888139110698->next is NULL [ 3102.986757] WARNING: CPU: 2 PID: 22109 at lib/listdebug.c:53 listdelentryvalidorreport+0x4f/0xc0 [ 3102.987561] Modules linked in: actct nfflowtable bonding acttunnelkey actmirred actskbedit vxlan clsmatchall nfnetlinkcttimeout actgact clsflower schingress mlx5vdpa vringh vhostiotlb vdpa openvswitch nsh xtMASQUERADE nfconntracknetlink nfnetlink iptablenat xtaddrtype xtconntrack nfnat brnetfilter rpcsecgsskrb5 authrpcg ss oidregistry overlay rpcrdma rdmaucm ibiser libiscsi scsitransportiscsi ibumad rdmacm ibipoib iwcm ibcm mlx5ib ibuverbs ibcore mlx5core [last unloaded: bonding] [ 3102.991113] CPU: 2 PID: 22109 Comm: revalidator28 Not tainted 6.6.0-rc6+ #3 [ 3102.991695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 3102.992605] RIP: 0010:listdelentryvalidorreport+0x4f/0xc0 [ 3102.993122] Code: 39 c2 74 56 48 8b 32 48 39 fe 75 62 48 8b 51 08 48 39 f2 75 73 b8 01 00 00 00 c3 48 89 fe 48 c7 c7 48 fd 0a 82 e8 41 0b ad ff <0f> 0b 31 c0 c3 48 89 fe 48 c7 c7 70 fd 0a 82 e8 2d 0b ad ff 0f 0b [ 3102.994615] RSP: 0018:ffff8881383e7710 EFLAGS: 00010286 [ 3102.995078] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 [ 3102.995670] RDX: 0000000000000001 RSI: ffff88885f89b640 RDI: ffff88885f89b640 [ 3102.997188] DEL flow 00000000be367878 on port 0 [ 3102.998594] RBP: dead000000000122 R08: 0000000000000000 R09: c0000000ffffdfff [ 3102.999604] R10: 0000000000000008 R11: ffff8881383e7598 R12: dead000000000100 [ 3103.000198] R13: 0000000000000002 R14: ffff888139110000 R15: ffff888101901240 [ 3103.000790] FS: 00007f424cde4700(0000) GS:ffff88885f880000(0000) knlGS:0000000000000000 [ 3103.001486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3103.001986] CR2: 00007fd42e8dcb70 CR3: 000000011e68a003 CR4: 0000000000370ea0 [ 3103.002596] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3103.003190] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3103.003787] Call Trace: [ 3103.004055] <TASK> [ 3103.004297] ? _warn+0x7d/0x130 [ 3103.004623] ? _listdelentryvalidorreport+0x4f/0xc0 [ 3103.005094] ? reportbug+0xf1/0x1c0 [ 3103.005439] ? consoleunlock+0x4a/0xd0 [ 3103.005806] ? handlebug+0x3f/0x70 [ 3103.006149] ? excinvalidop+0x13/0x60 [ 3103.006531] ? asmexcinvalidop+0x16/0x20 [ 3103.007430] ? _listdelentryvalidorreport+0x4f/0xc0 [ 3103.007910] mlx5etcdelfdbpeersflow+0xcf/0x240 [mlx5core] [ 3103.008463] mlx5etcdelflow+0x46/0x270 [mlx5core] [ 3103.008944] mlx5eflowput+0x26/0x50 [mlx5core] [ 3103.009401] mlx5edeleteflower+0x25f/0x380 [mlx5core] [ 3103.009901] tcsetupcbdestroy+0xab/0x180 [ 3103.010292] flhwdestroyfilter+0x99/0xc0 [clsflower] [ 3103.010779] _fldelete+0x2d4/0x2f0 [clsflower] [ 3103.0 ---truncated---

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6
Fixed
74cec142f89bf85c6c99c5db957da9f663f9f16f
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6
Fixed
e24d6f5a7f2d95a98a46257a5a5a5381d572894f
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6
Fixed
d76fdd31f953ac5046555171620f2562715e9b71

Affected versions

v6.*

v6.4
v6.4-rc5
v6.4-rc6
v6.4-rc7
v6.5
v6.5-rc1
v6.5-rc2
v6.5-rc3
v6.5-rc4
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.2
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.7.1
v6.7.2

Database specific

vanir_signatures

[
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74cec142f89bf85c6c99c5db957da9f663f9f16f",
        "signature_version": "v1",
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "155801606997800022809331855703204599495",
                "18813751703329204083543307082774186080",
                "38854826063587286594394181684036577800",
                "131392462426778424516872299971696994108",
                "190552044178230835966452631363140052500",
                "328502338831873788011931911191534825515",
                "175914468192003187125237097687951686270"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2023-52487-02acf7e9"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d76fdd31f953ac5046555171620f2562715e9b71",
        "signature_version": "v1",
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c",
            "function": "mlx5e_tc_del_fdb_peer_flow"
        },
        "digest": {
            "length": 687.0,
            "function_hash": "279375092785665591462648236650643961946"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2023-52487-1709d311"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e24d6f5a7f2d95a98a46257a5a5a5381d572894f",
        "signature_version": "v1",
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "155801606997800022809331855703204599495",
                "18813751703329204083543307082774186080",
                "38854826063587286594394181684036577800",
                "131392462426778424516872299971696994108",
                "190552044178230835966452631363140052500",
                "328502338831873788011931911191534825515",
                "175914468192003187125237097687951686270"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2023-52487-88d5c66b"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74cec142f89bf85c6c99c5db957da9f663f9f16f",
        "signature_version": "v1",
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c",
            "function": "mlx5e_tc_del_fdb_peer_flow"
        },
        "digest": {
            "length": 687.0,
            "function_hash": "279375092785665591462648236650643961946"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2023-52487-903fbb04"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e24d6f5a7f2d95a98a46257a5a5a5381d572894f",
        "signature_version": "v1",
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c",
            "function": "mlx5e_tc_del_fdb_peer_flow"
        },
        "digest": {
            "length": 687.0,
            "function_hash": "279375092785665591462648236650643961946"
        },
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2023-52487-9499946c"
    },
    {
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d76fdd31f953ac5046555171620f2562715e9b71",
        "signature_version": "v1",
        "target": {
            "file": "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "155801606997800022809331855703204599495",
                "18813751703329204083543307082774186080",
                "38854826063587286594394181684036577800",
                "131392462426778424516872299971696994108",
                "190552044178230835966452631363140052500",
                "328502338831873788011931911191534825515",
                "175914468192003187125237097687951686270"
            ]
        },
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2023-52487-e0d1e277"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.5.0
Fixed
6.6.15
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.7.3