In the Linux kernel, the following vulnerability has been resolved:
ipv6/addrconf: fix a potential refcount underflow for idev
Now in addrconfmodrstimer(), reference idev depends on whether rstimer is not pending. Then modify rs_timer timeout.
There is a time gap in [1], during which if the pending rstimer becomes not pending. It will miss to hold idev, but the rstimer is activated. Thus rstimer callback function addrconfrs_timer() will be executed and put idev later without holding idev. A refcount underflow issue for idev can be caused by this.
if (!timer_pending(&idev->rs_timer))
in6_dev_hold(idev);
<--------------[1]
mod_timer(&idev->rs_timer, jiffies + when);
To fix the issue, hold idev if mod_timer() return 0.
[
{
"id": "CVE-2023-53189-19376507",
"target": {
"function": "addrconf_mod_rs_timer",
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df62fdcd004afa72ecbed0e862ebb983acd3aa57",
"signature_type": "Function",
"digest": {
"function_hash": "87236716524511572192256920965930822671",
"length": 182.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-21bcb456",
"target": {
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6395e32935d35e6f935e7caf1c2dac5a95943b4",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"97192003855890407225262794414194043991",
"300347224316926978617621674013205875208",
"292158873518133758421726737067806985736",
"181950697632074031877403485412172663754",
"64463639076188977517787023966306862227",
"215487811769993015934980171727597026651"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-2614765f",
"target": {
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@436b7cc7eae7851c184b671ed7a4a64c750b86f7",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"97192003855890407225262794414194043991",
"300347224316926978617621674013205875208",
"292158873518133758421726737067806985736",
"181950697632074031877403485412172663754",
"64463639076188977517787023966306862227",
"215487811769993015934980171727597026651"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-350dda88",
"target": {
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ad31ce40e8182860b631e37209e93e543790b7c",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"97192003855890407225262794414194043991",
"300347224316926978617621674013205875208",
"292158873518133758421726737067806985736",
"181950697632074031877403485412172663754",
"64463639076188977517787023966306862227",
"215487811769993015934980171727597026651"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-5d993b2e",
"target": {
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06a0716949c22e2aefb648526580671197151acc",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"97192003855890407225262794414194043991",
"300347224316926978617621674013205875208",
"292158873518133758421726737067806985736",
"181950697632074031877403485412172663754",
"64463639076188977517787023966306862227",
"215487811769993015934980171727597026651"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-6076bcff",
"target": {
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f656e483eb4733d62f18dfb206a49b78f60f495",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"97192003855890407225262794414194043991",
"300347224316926978617621674013205875208",
"292158873518133758421726737067806985736",
"181950697632074031877403485412172663754",
"64463639076188977517787023966306862227",
"215487811769993015934980171727597026651"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-61b5b5b1",
"target": {
"function": "addrconf_mod_rs_timer",
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06a0716949c22e2aefb648526580671197151acc",
"signature_type": "Function",
"digest": {
"function_hash": "87236716524511572192256920965930822671",
"length": 182.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-8f927374",
"target": {
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82abd1c37d3bf2a2658b34772c17a25a6f9cca42",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"97192003855890407225262794414194043991",
"300347224316926978617621674013205875208",
"292158873518133758421726737067806985736",
"181950697632074031877403485412172663754",
"64463639076188977517787023966306862227",
"215487811769993015934980171727597026651"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-9240b944",
"target": {
"function": "addrconf_mod_rs_timer",
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82abd1c37d3bf2a2658b34772c17a25a6f9cca42",
"signature_type": "Function",
"digest": {
"function_hash": "87236716524511572192256920965930822671",
"length": 182.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-d0892c08",
"target": {
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7eeba47058532f6077d6a658e38b6698f6ae71a",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"97192003855890407225262794414194043991",
"300347224316926978617621674013205875208",
"292158873518133758421726737067806985736",
"181950697632074031877403485412172663754",
"64463639076188977517787023966306862227",
"215487811769993015934980171727597026651"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-d3ff4253",
"target": {
"function": "addrconf_mod_rs_timer",
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ad31ce40e8182860b631e37209e93e543790b7c",
"signature_type": "Function",
"digest": {
"function_hash": "87236716524511572192256920965930822671",
"length": 182.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-ee8cf7cf",
"target": {
"function": "addrconf_mod_rs_timer",
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@436b7cc7eae7851c184b671ed7a4a64c750b86f7",
"signature_type": "Function",
"digest": {
"function_hash": "87236716524511572192256920965930822671",
"length": 182.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-ef0ec172",
"target": {
"function": "addrconf_mod_rs_timer",
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f656e483eb4733d62f18dfb206a49b78f60f495",
"signature_type": "Function",
"digest": {
"function_hash": "87236716524511572192256920965930822671",
"length": 182.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-f364ab80",
"target": {
"function": "addrconf_mod_rs_timer",
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6395e32935d35e6f935e7caf1c2dac5a95943b4",
"signature_type": "Function",
"digest": {
"function_hash": "87236716524511572192256920965930822671",
"length": 182.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-f4933d0d",
"target": {
"function": "addrconf_mod_rs_timer",
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7eeba47058532f6077d6a658e38b6698f6ae71a",
"signature_type": "Function",
"digest": {
"function_hash": "87236716524511572192256920965930822671",
"length": 182.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2023-53189-fc0fdf80",
"target": {
"file": "net/ipv6/addrconf.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@df62fdcd004afa72ecbed0e862ebb983acd3aa57",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"97192003855890407225262794414194043991",
"300347224316926978617621674013205875208",
"292158873518133758421726737067806985736",
"181950697632074031877403485412172663754",
"64463639076188977517787023966306862227",
"215487811769993015934980171727597026651"
]
},
"deprecated": false,
"signature_version": "v1"
}
]