In the Linux kernel, the following vulnerability has been resolved:
xfrm: add NULL check in xfrmupdateae_params
Normally, x->replayesn and x->preplayesn should be allocated at xfrmallocreplaystateesn(...) in xfrmstateconstruct(...), hence the xfrmupdateaeparams(...) is okay to update them. However, the current implementation of xfrmnew_ae(...) allows a malicious user to directly dereference a NULL pointer and crash the kernel like below.
BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4 RIP: 0010:memcpyorig+0xad/0x140 Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c RSP: 0018:ffff888008f57658 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571 RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818 R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 Call Trace: <TASK> ? die+0x1f/0x70 ? pagefaultoops+0x1e8/0x500 ? _pfxisprefetch.constprop.0+0x10/0x10 ? _pfxpagefaultoops+0x10/0x10 ? rawspinunlockirqrestore+0x11/0x40 ? fixupexception+0x36/0x460 ? _rawspinunlockirqrestore+0x11/0x40 ? excpagefault+0x5e/0xc0 ? asmexcpagefault+0x26/0x30 ? xfrmupdateaeparams+0xd1/0x260 ? memcpyorig+0xad/0x140 ? _pfxrawspinlockbh+0x10/0x10 xfrmupdateaeparams+0xe7/0x260 xfrmnewae+0x298/0x4e0 ? _pfxxfrmnewae+0x10/0x10 ? _pfxxfrmnewae+0x10/0x10 xfrmuserrcvmsg+0x25a/0x410 ? _pfxxfrmuserrcvmsg+0x10/0x10 ? _allocskb+0xcf/0x210 ? stacktracesave+0x90/0xd0 ? filterirqstacks+0x1c/0x70 ? _stackdepotsave+0x39/0x4e0 ? _kasanslabfree+0x10a/0x190 ? kmemcachefree+0x9c/0x340 ? netlinkrecvmsg+0x23c/0x660 ? sockrecvmsg+0xeb/0xf0 ? _sysrecvfrom+0x13c/0x1f0 ? _x64sysrecvfrom+0x71/0x90 ? dosyscall64+0x3f/0x90 ? entrySYSCALL64afterhwframe+0x72/0xdc ? copyout+0x3e/0x50 netlinkrcvskb+0xd6/0x210 ? _pfxxfrmuserrcvmsg+0x10/0x10 ? _pfxnetlinkrcvskb+0x10/0x10 ? _pfxsockhasperm+0x10/0x10 ? mutexlock+0x8d/0xe0 ? _pfxmutexlock+0x10/0x10 xfrmnetlinkrcv+0x44/0x50 netlinkunicast+0x36f/0x4c0 ? _pfxnetlinkunicast+0x10/0x10 ? netlinkrecvmsg+0x500/0x660 netlinksendmsg+0x3b7/0x700
This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit adds additional NULL check in xfrmupdateae_params to fix the NPD.
[
{
"deprecated": false,
"id": "CVE-2023-53147-26530617",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53df4be4f5221e90dc7aa9ce745a9a21bb7024f4",
"digest": {
"function_hash": "234289631834234460583713483167479185319",
"length": 1097.0
},
"target": {
"function": "xfrm_update_ae_params",
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-60fdb84b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd30aa9c7febb6e709670cd5154194189ca3b7b5",
"digest": {
"line_hashes": [
"190939527435646610836072664476763768221",
"75281332228835530524211259316982992340",
"191289576360252224107050969948767206508",
"96416502941770118269752393958169075028"
],
"threshold": 0.9
},
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-7fcaa8e4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00374d9b6d9f932802b55181be9831aa948e5b7c",
"digest": {
"line_hashes": [
"190939527435646610836072664476763768221",
"75281332228835530524211259316982992340",
"191289576360252224107050969948767206508",
"96416502941770118269752393958169075028"
],
"threshold": 0.9
},
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-81b7affb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@87b655f4936b6fc01f3658aa88a22c923b379ebd",
"digest": {
"line_hashes": [
"190939527435646610836072664476763768221",
"75281332228835530524211259316982992340",
"191289576360252224107050969948767206508",
"96416502941770118269752393958169075028"
],
"threshold": 0.9
},
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-9026513c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed1cba039309c80b49719fcff3e3d7cdddb73d96",
"digest": {
"line_hashes": [
"260417136213218916505729210755656495486",
"226798846839121620178621389859869596715",
"170424125453961870764915414169301519642",
"96416502941770118269752393958169075028"
],
"threshold": 0.9
},
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-992cf9fc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8046beb890ebc83c5820188c650073e1c6066e67",
"digest": {
"line_hashes": [
"260417136213218916505729210755656495486",
"226798846839121620178621389859869596715",
"170424125453961870764915414169301519642",
"96416502941770118269752393958169075028"
],
"threshold": 0.9
},
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-bea32b25",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44f69c96f8a147413c23c68cda4d6fb5e23137cd",
"digest": {
"function_hash": "152408671498560500422548717374940052062",
"length": 995.0
},
"target": {
"function": "xfrm_update_ae_params",
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-c1afcf0a",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@44f69c96f8a147413c23c68cda4d6fb5e23137cd",
"digest": {
"line_hashes": [
"260417136213218916505729210755656495486",
"226798846839121620178621389859869596715",
"170424125453961870764915414169301519642",
"96416502941770118269752393958169075028"
],
"threshold": 0.9
},
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-c2d0e983",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@075448a2eb753f813fe873cfa52853e9fef8eedb",
"digest": {
"function_hash": "234289631834234460583713483167479185319",
"length": 1097.0
},
"target": {
"function": "xfrm_update_ae_params",
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-c2e0f203",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@87b655f4936b6fc01f3658aa88a22c923b379ebd",
"digest": {
"function_hash": "234289631834234460583713483167479185319",
"length": 1097.0
},
"target": {
"function": "xfrm_update_ae_params",
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-c8f6a305",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8046beb890ebc83c5820188c650073e1c6066e67",
"digest": {
"function_hash": "152408671498560500422548717374940052062",
"length": 995.0
},
"target": {
"function": "xfrm_update_ae_params",
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-ca499dd1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd30aa9c7febb6e709670cd5154194189ca3b7b5",
"digest": {
"function_hash": "234289631834234460583713483167479185319",
"length": 1097.0
},
"target": {
"function": "xfrm_update_ae_params",
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-d0657e2b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@075448a2eb753f813fe873cfa52853e9fef8eedb",
"digest": {
"line_hashes": [
"190939527435646610836072664476763768221",
"75281332228835530524211259316982992340",
"191289576360252224107050969948767206508",
"96416502941770118269752393958169075028"
],
"threshold": 0.9
},
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-d0adc46b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ed1cba039309c80b49719fcff3e3d7cdddb73d96",
"digest": {
"function_hash": "152408671498560500422548717374940052062",
"length": 995.0
},
"target": {
"function": "xfrm_update_ae_params",
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-f8894cf8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@53df4be4f5221e90dc7aa9ce745a9a21bb7024f4",
"digest": {
"line_hashes": [
"190939527435646610836072664476763768221",
"75281332228835530524211259316982992340",
"191289576360252224107050969948767206508",
"96416502941770118269752393958169075028"
],
"threshold": 0.9
},
"target": {
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"id": "CVE-2023-53147-ffb2253d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00374d9b6d9f932802b55181be9831aa948e5b7c",
"digest": {
"function_hash": "234289631834234460583713483167479185319",
"length": 1097.0
},
"target": {
"function": "xfrm_update_ae_params",
"file": "net/xfrm/xfrm_user.c"
},
"signature_type": "Function",
"signature_version": "v1"
}
]