In the Linux kernel, the following vulnerability has been resolved:
tcp: tcpmakesynack() can be called from process context
tcprtxsynack() now could be called in process context as explained in 0a375c822497 ("tcp: tcprtxsynack() can be called from process context").
tcprtxsynack() might call tcpmakesynack(), which will touch per-CPU variables with preemption enabled. This causes the following BUG:
BUG: using __this_cpu_add() in preemptible [00000000] code: ThriftIO1/5464
caller is tcp_make_synack+0x841/0xac0
Call Trace:
<TASK>
dump_stack_lvl+0x10d/0x1a0
check_preemption_disabled+0x104/0x110
tcp_make_synack+0x841/0xac0
tcp_v6_send_synack+0x5c/0x450
tcp_rtx_synack+0xeb/0x1f0
inet_rtx_syn_ack+0x34/0x60
tcp_check_req+0x3af/0x9e0
tcp_rcv_state_process+0x59b/0x2030
tcp_v6_do_rcv+0x5f5/0x700
release_sock+0x3a/0xf0
tcp_sendmsg+0x33/0x40
____sys_sendmsg+0x2f2/0x490
__sys_sendmsg+0x184/0x230
do_syscall_64+0x3d/0x90
Avoid calling __TCPINCSTATS() with will touch per-cpu variables. Use TCPINCSTATS() which is safe to be called from context switch.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53121.json",
"cna_assigner": "Linux"
}[
{
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/ipv4/tcp_output.c"
},
"id": "CVE-2023-53121-43617f4b",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad07290d63ff6689f50565b02f5b6f34ec15a5ca",
"digest": {
"line_hashes": [
"185350671356968061877890889100697513188",
"84939974578674318806949680808219940456",
"312158523604593821933354579360006786377",
"328656466067269787155309705255961242173"
],
"threshold": 0.9
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53121.json"