CVE-2023-53103
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-53103
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53103.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-53103
- Downstream
- Related
- Published
- 2025-05-02T15:55:45Z
- Modified
- 2025-10-21T16:05:30.524722Z
- Summary
- bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
syzbot reported a warning[1] where the bond device itself is a slave and we try to enslave a non-ethernet device as the first slave which fails but then in the error path when ethersetup() restores the bond device it also clears all flags. In my previous fix[2] I restored the IFFMASTER flag, but I didn't consider the case that the bond device itself might also be a slave with IFFSLAVE set, so we need to restore that flag as well. Use the bondether_setup helper which does the right thing and restores the bond's flags properly.
Steps to reproduce using a nlmon dev: $ ip l add nlmon0 type nlmon $ ip l add bond1 type bond $ ip l add bond2 type bond $ ip l set bond1 master bond2 $ ip l set dev nlmon0 master bond1 $ ip -d l sh dev bond1 22: bond1: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noqueue master bond2 state DOWN mode DEFAULT group default qlen 1000 (now bond1's IFF_SLAVE flag is gone and we'll hit a warning[3] if we try to delete it)
[1] https://syzkaller.appspot.com/bug?id=391c7b1f6522182899efba27d891f1743e8eb3ef [2] commit 7d5cd2ce5292 ("bonding: correctly handle bonding type change on enslave failure") [3] example warning: [ 27.008664] bond1: (slave nlmon0): The slave device specified does not support setting the MAC address [ 27.008692] bond1: (slave nlmon0): Error -95 calling setmacaddress [ 32.464639] bond1 (unregistering): Released all slaves [ 32.464685] ------------[ cut here ]------------ [ 32.464686] WARNING: CPU: 1 PID: 2004 at net/core/dev.c:10829 unregisternetdevicemany+0x72a/0x780 [ 32.464694] Modules linked in: brnetfilter bridge bonding virtionet [ 32.464699] CPU: 1 PID: 2004 Comm: ip Kdump: loaded Not tainted 5.18.0-rc3+ #47 [ 32.464703] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014 [ 32.464704] RIP: 0010:unregisternetdevicemany+0x72a/0x780 [ 32.464707] Code: 99 fd ff ff ba 90 1a 00 00 48 c7 c6 f4 02 66 96 48 c7 c7 20 4d 35 96 c6 05 fa c7 2b 02 01 e8 be 6f 4a 00 0f 0b e9 73 fd ff ff <0f> 0b e9 5f fd ff ff 80 3d e3 c7 2b 02 00 0f 85 3b fd ff ff ba 59 [ 32.464710] RSP: 0018:ffffa006422d7820 EFLAGS: 00010206 [ 32.464712] RAX: ffff8f6e077140a0 RBX: ffffa006422d7888 RCX: 0000000000000000 [ 32.464714] RDX: ffff8f6e12edbe58 RSI: 0000000000000296 RDI: ffffffff96d4a520 [ 32.464716] RBP: ffff8f6e07714000 R08: ffffffff96d63600 R09: ffffa006422d7728 [ 32.464717] R10: 0000000000000ec0 R11: ffffffff9698c988 R12: ffff8f6e12edb140 [ 32.464719] R13: dead000000000122 R14: dead000000000100 R15: ffff8f6e12edb140 [ 32.464723] FS: 00007f297c2f1740(0000) GS:ffff8f6e5d900000(0000) knlGS:0000000000000000 [ 32.464725] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.464726] CR2: 00007f297bf1c800 CR3: 00000000115e8000 CR4: 0000000000350ee0 [ 32.464730] Call Trace: [ 32.464763] <TASK> [ 32.464767] rtnldellink+0x13e/0x380 [ 32.464776] ? credhascapability.isra.0+0x68/0x100 [ 32.464780] ? rtnlunlock+0x33/0x60 [ 32.464783] ? bpflsmcapset+0x10/0x10 [ 32.464786] ? securitycapable+0x36/0x50 [ 32.464790] rtnetlinkrcvmsg+0x14e/0x3b0 [ 32.464792] ? _copytoiter+0xb1/0x790 [ 32.464796] ? postallochook+0xa0/0x160 [ 32.464799] ? rtnlcalcit.isra.0+0x110/0x110 [ 32.464802] netlinkrcvskb+0x50/0xf0 [ 32.464806] netlinkunicast+0x216/0x340 [ 32.464809] netlinksendmsg+0x23f/0x480 [ 32.464812] socksendmsg+0x5e/0x60 [ 32.464815] _syssendmsg+0x22c/0x270 [ 32.464818] ? importiovec+0x17/0x20 [ 32.464821] ? sendmsgcopymsghdr+0x59/0x90 [ 32.464823] ? dosetpte+0xa0/0xe0 [ 32.464828] _syssendmsg+0x81/0xc0 [ 32.464832] ? modobjcgstate+0xc6/0x300 [ 32.464835] ? refillobjstock+0xa9/0x160 [ 32.464838] ? memcgslabfreehook+0x1a5/0x1f0 [ 32.464842] _syssendm ---truncated---
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/0276813b8ab08d9bf5ca4159f301d0829ecf13fc
- https://git.kernel.org/stable/c/93c8cbeb1b2b8ff670b3dfd01b3abd843995c80f
- https://git.kernel.org/stable/c/e667d469098671261d558be0cd93dca4d285ce1e
- https://git.kernel.org/stable/c/ecb1b5135bd3f232d5335b3935e2c2ac11bfa02f
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7d5cd2ce5292b45e555de776cb9e72975a07460dFixed93c8cbeb1b2b8ff670b3dfd01b3abd843995c80f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7d5cd2ce5292b45e555de776cb9e72975a07460dFixedecb1b5135bd3f232d5335b3935e2c2ac11bfa02f
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7d5cd2ce5292b45e555de776cb9e72975a07460dFixed0276813b8ab08d9bf5ca4159f301d0829ecf13fc
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced7d5cd2ce5292b45e555de776cb9e72975a07460dFixede667d469098671261d558be0cd93dca4d285ce1e
Affected versions
v4.*
v5.*
v6.*
Database specific
vanir_signatures
[
{
"id": "CVE-2023-53103-04aad276",
"target": {
"file": "drivers/net/bonding/bond_main.c"
},
"digest": {
"line_hashes": [
"255572373124566089155712747063855198577",
"18675477661402522188326493643582342808",
"140330874349049576993204218714043732496",
"326217164725671731464629172341901301947",
"231630831932962834742733776678721596991",
"230609320530051440097934248232049899854"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93c8cbeb1b2b8ff670b3dfd01b3abd843995c80f",
"signature_type": "Line"
},
{
"id": "CVE-2023-53103-5349d5a5",
"target": {
"function": "bond_enslave",
"file": "drivers/net/bonding/bond_main.c"
},
"digest": {
"length": 10845.0,
"function_hash": "37674307995765767792482351317015017927"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@93c8cbeb1b2b8ff670b3dfd01b3abd843995c80f",
"signature_type": "Function"
},
{
"id": "CVE-2023-53103-53c85c89",
"target": {
"file": "drivers/net/bonding/bond_main.c"
},
"digest": {
"line_hashes": [
"255572373124566089155712747063855198577",
"18675477661402522188326493643582342808",
"140330874349049576993204218714043732496",
"326217164725671731464629172341901301947",
"231630831932962834742733776678721596991",
"230609320530051440097934248232049899854"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecb1b5135bd3f232d5335b3935e2c2ac11bfa02f",
"signature_type": "Line"
},
{
"id": "CVE-2023-53103-a6a6a095",
"target": {
"function": "bond_enslave",
"file": "drivers/net/bonding/bond_main.c"
},
"digest": {
"length": 10852.0,
"function_hash": "92259863224682706384212612544753395154"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecb1b5135bd3f232d5335b3935e2c2ac11bfa02f",
"signature_type": "Function"
},
{
"id": "CVE-2023-53103-c4184e3e",
"target": {
"function": "bond_enslave",
"file": "drivers/net/bonding/bond_main.c"
},
"digest": {
"length": 10874.0,
"function_hash": "219279217206148785139125775099247146642"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e667d469098671261d558be0cd93dca4d285ce1e",
"signature_type": "Function"
},
{
"id": "CVE-2023-53103-cdee9e85",
"target": {
"file": "drivers/net/bonding/bond_main.c"
},
"digest": {
"line_hashes": [
"255572373124566089155712747063855198577",
"18675477661402522188326493643582342808",
"140330874349049576993204218714043732496",
"326217164725671731464629172341901301947",
"231630831932962834742733776678721596991",
"230609320530051440097934248232049899854"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0276813b8ab08d9bf5ca4159f301d0829ecf13fc",
"signature_type": "Line"
},
{
"id": "CVE-2023-53103-d32b43fd",
"target": {
"file": "drivers/net/bonding/bond_main.c"
},
"digest": {
"line_hashes": [
"255572373124566089155712747063855198577",
"18675477661402522188326493643582342808",
"140330874349049576993204218714043732496",
"326217164725671731464629172341901301947",
"231630831932962834742733776678721596991",
"230609320530051440097934248232049899854"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e667d469098671261d558be0cd93dca4d285ce1e",
"signature_type": "Line"
},
{
"id": "CVE-2023-53103-ed1579cb",
"target": {
"function": "bond_enslave",
"file": "drivers/net/bonding/bond_main.c"
},
"digest": {
"length": 10874.0,
"function_hash": "219279217206148785139125775099247146642"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0276813b8ab08d9bf5ca4159f301d0829ecf13fc",
"signature_type": "Function"
}
]