In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
Eric Dumazet says: nfconntrackdccp_packet() has an unique:
dh = skbheaderpointer(skb, dataoff, sizeof(dh), &dh);
And nothing more is 'pulled' from the packet, depending on the content. dh->dccphdoff, and/or dh->dccphx ...) So dccpackseq() is happily reading stuff past the _dh buffer.
BUG: KASAN: stack-out-of-bounds in nfconntrackdccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 [..]
Fix this by increasing the stack buffer to also include room for the extra sequence numbers and all the known dccp packet type headers, then pull again after the initial validation of the basic header.
While at it, mark packets invalid that lack 48bit sequence bit but where RFC says the type MUST use them.
Compile tested only.
v2: first skbheaderpointer() now needs to adjust the size to only pull the generic header. (Eric)
Heads-up: I intend to remove dccp conntrack support later this year.
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@337fdce450637ea663bc816edc2ba81e5cdad02e", "target": { "function": "nf_conntrack_dccp_packet", "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Function", "deprecated": false, "digest": { "function_hash": "216343058642649487550608715393757677918", "length": 2429.0 }, "signature_version": "v1", "id": "CVE-2023-53333-00f2ee83" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c052797ac36813419ad3bfa54cb8615db4b41f15", "target": { "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Line", "deprecated": false, "digest": { "line_hashes": [ "11593223847775709853444142991544037467", "79426671346644887118789327018201784197", "285913395675500349537702435615810976086", "820477183744508266636097191440518755", "118383094947315710549425258114951859860", "123898631085769092425977731701993192826", "156444356580388781430289752830286612543", "229871836767802548960436738652631864678", "204529289387016275660550970135724605948", "215563960684099633944738103022939328303", "258075207250978468462467935209827187844", "206860140479998375326568971761185115282", "312463499335724314482354898621072405324", "220322828966697057260372886099047632589", "167215717994580683023348643049495850151", "189584181895369343014679525373047221672", "179770806376447080049431126264291613439", "97341317166121723733462051049833171649", "148540345782425594481812087397005917520", "332592662185978142651547833633561994572", "333477478411179154698230098409707582819", "83872791959970446940066303004490947747", "226631513623994200900713736044830703145", "334894576687285883083648593697974453771", "333446833404730724074620119875764299640", "227804690338480929301062867916928746824", "75431274063039332748128717589188211508", "261934814158887440793846442061183730228", "239299701359475614711665780422300739223", "135612542521385465026334571809290460991", "216321100620008711872814999113328172324", "224300336386691462936486166501489407248", "131137606913172897702868116386074418441", "330830503981997786862380347677901787825" ], "threshold": 0.9 }, "signature_version": "v1", "id": "CVE-2023-53333-02d8d9ca" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c0980493beed3a80d6329c44ab293dc8c032927", "target": { "function": "nf_conntrack_dccp_packet", "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Function", "deprecated": false, "digest": { "function_hash": "306697854976232845563512950578739088264", "length": 2453.0 }, "signature_version": "v1", "id": "CVE-2023-53333-0886ace4" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@337fdce450637ea663bc816edc2ba81e5cdad02e", "target": { "function": "dccp_error", "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Function", "deprecated": false, "digest": { "function_hash": "277148851053827165855436387586394754599", "length": 980.0 }, "signature_version": "v1", "id": "CVE-2023-53333-0c011074" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c618daa5038712c4a4ef8923905a2ea1b8836a1", "target": { "function": "dccp_error", "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Function", "deprecated": false, "digest": { "function_hash": "225775724475342073063268207331737157183", "length": 959.0 }, "signature_version": "v1", "id": "CVE-2023-53333-1b20e18c" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30", "target": { "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Line", "deprecated": false, "digest": { "line_hashes": [ "11593223847775709853444142991544037467", "79426671346644887118789327018201784197", "285913395675500349537702435615810976086", "820477183744508266636097191440518755", "118383094947315710549425258114951859860", "123898631085769092425977731701993192826", "156444356580388781430289752830286612543", "229871836767802548960436738652631864678", "204529289387016275660550970135724605948", "215563960684099633944738103022939328303", "258075207250978468462467935209827187844", "206860140479998375326568971761185115282", "312463499335724314482354898621072405324", "220322828966697057260372886099047632589", "167215717994580683023348643049495850151", "189584181895369343014679525373047221672", "179770806376447080049431126264291613439", "97341317166121723733462051049833171649", "148540345782425594481812087397005917520", "332592662185978142651547833633561994572", "333477478411179154698230098409707582819", "83872791959970446940066303004490947747", "226631513623994200900713736044830703145", "334894576687285883083648593697974453771", "333446833404730724074620119875764299640", "227804690338480929301062867916928746824", "75431274063039332748128717589188211508", "261934814158887440793846442061183730228", "239299701359475614711665780422300739223", "135612542521385465026334571809290460991", "216321100620008711872814999113328172324", "224300336386691462936486166501489407248", "131137606913172897702868116386074418441", "330830503981997786862380347677901787825" ], "threshold": 0.9 }, "signature_version": "v1", "id": "CVE-2023-53333-1ccf763d" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c0980493beed3a80d6329c44ab293dc8c032927", "target": { "function": "dccp_error", "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Function", "deprecated": false, "digest": { "function_hash": "225775724475342073063268207331737157183", "length": 959.0 }, "signature_version": "v1", "id": "CVE-2023-53333-32c61e9f" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c052797ac36813419ad3bfa54cb8615db4b41f15", "target": { "function": "nf_conntrack_dccp_packet", "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Function", "deprecated": false, "digest": { "function_hash": "306697854976232845563512950578739088264", "length": 2453.0 }, "signature_version": "v1", "id": "CVE-2023-53333-5374efc8" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9bdcda7abaf22f6453e5b5efb7eb4e524095d5d8", "target": { "function": "nf_conntrack_dccp_packet", "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Function", "deprecated": false, "digest": { "function_hash": "216343058642649487550608715393757677918", "length": 2429.0 }, "signature_version": "v1", "id": "CVE-2023-53333-63bb1fd2" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26bd1f210d3783a691052c51d76bb8a8bbd24c67", "target": { "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Line", "deprecated": false, "digest": { "line_hashes": [ "11593223847775709853444142991544037467", "79426671346644887118789327018201784197", "285913395675500349537702435615810976086", "820477183744508266636097191440518755", "118383094947315710549425258114951859860", "123898631085769092425977731701993192826", "156444356580388781430289752830286612543", "229871836767802548960436738652631864678", "204529289387016275660550970135724605948", "215563960684099633944738103022939328303", "258075207250978468462467935209827187844", "206860140479998375326568971761185115282", "312463499335724314482354898621072405324", "220322828966697057260372886099047632589", "167215717994580683023348643049495850151", "189584181895369343014679525373047221672", "179770806376447080049431126264291613439", "97341317166121723733462051049833171649", "148540345782425594481812087397005917520", "332592662185978142651547833633561994572", "333477478411179154698230098409707582819", "83872791959970446940066303004490947747", "226631513623994200900713736044830703145", "334894576687285883083648593697974453771", "333446833404730724074620119875764299640", "227804690338480929301062867916928746824", "75431274063039332748128717589188211508", "261934814158887440793846442061183730228", "239299701359475614711665780422300739223", "135612542521385465026334571809290460991", "216321100620008711872814999113328172324", "224300336386691462936486166501489407248", "131137606913172897702868116386074418441", "330830503981997786862380347677901787825" ], "threshold": 0.9 }, "signature_version": "v1", "id": "CVE-2023-53333-82568c43" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30", "target": { "function": "nf_conntrack_dccp_packet", "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Function", "deprecated": false, "digest": { "function_hash": "306697854976232845563512950578739088264", "length": 2453.0 }, "signature_version": "v1", "id": "CVE-2023-53333-857bb034" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c0980493beed3a80d6329c44ab293dc8c032927", "target": { "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Line", "deprecated": false, "digest": { "line_hashes": [ "11593223847775709853444142991544037467", "79426671346644887118789327018201784197", "285913395675500349537702435615810976086", "820477183744508266636097191440518755", "118383094947315710549425258114951859860", "123898631085769092425977731701993192826", "156444356580388781430289752830286612543", "229871836767802548960436738652631864678", "204529289387016275660550970135724605948", "215563960684099633944738103022939328303", "258075207250978468462467935209827187844", "206860140479998375326568971761185115282", "312463499335724314482354898621072405324", "220322828966697057260372886099047632589", "167215717994580683023348643049495850151", "189584181895369343014679525373047221672", "179770806376447080049431126264291613439", "97341317166121723733462051049833171649", "148540345782425594481812087397005917520", "332592662185978142651547833633561994572", "333477478411179154698230098409707582819", "83872791959970446940066303004490947747", "226631513623994200900713736044830703145", "334894576687285883083648593697974453771", "333446833404730724074620119875764299640", "227804690338480929301062867916928746824", "75431274063039332748128717589188211508", "261934814158887440793846442061183730228", "239299701359475614711665780422300739223", "135612542521385465026334571809290460991", "216321100620008711872814999113328172324", "224300336386691462936486166501489407248", "131137606913172897702868116386074418441", "330830503981997786862380347677901787825" ], "threshold": 0.9 }, "signature_version": "v1", "id": "CVE-2023-53333-95c63388" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c618daa5038712c4a4ef8923905a2ea1b8836a1", "target": { "function": "nf_conntrack_dccp_packet", "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Function", "deprecated": false, "digest": { "function_hash": "306697854976232845563512950578739088264", "length": 2453.0 }, "signature_version": "v1", "id": "CVE-2023-53333-9f30bf03" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26bd1f210d3783a691052c51d76bb8a8bbd24c67", "target": { "function": "dccp_error", "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Function", "deprecated": false, "digest": { "function_hash": "225775724475342073063268207331737157183", "length": 959.0 }, "signature_version": "v1", "id": "CVE-2023-53333-af505f7c" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30", "target": { "function": "dccp_error", "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Function", "deprecated": false, "digest": { "function_hash": "225775724475342073063268207331737157183", "length": 959.0 }, "signature_version": "v1", "id": "CVE-2023-53333-afcde58e" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9bdcda7abaf22f6453e5b5efb7eb4e524095d5d8", "target": { "function": "dccp_error", "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Function", "deprecated": false, "digest": { "function_hash": "277148851053827165855436387586394754599", "length": 980.0 }, "signature_version": "v1", "id": "CVE-2023-53333-bb45f399" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c052797ac36813419ad3bfa54cb8615db4b41f15", "target": { "function": "dccp_error", "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Function", "deprecated": false, "digest": { "function_hash": "225775724475342073063268207331737157183", "length": 959.0 }, "signature_version": "v1", "id": "CVE-2023-53333-dcaf884b" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@337fdce450637ea663bc816edc2ba81e5cdad02e", "target": { "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Line", "deprecated": false, "digest": { "line_hashes": [ "11593223847775709853444142991544037467", "79426671346644887118789327018201784197", "285913395675500349537702435615810976086", "820477183744508266636097191440518755", "118383094947315710549425258114951859860", "123898631085769092425977731701993192826", "156444356580388781430289752830286612543", "229871836767802548960436738652631864678", "204529289387016275660550970135724605948", "215563960684099633944738103022939328303", "258075207250978468462467935209827187844", "206860140479998375326568971761185115282", "312463499335724314482354898621072405324", "218420947322252785603239713335232874604", "117831538149041431787707124745359206670", "97341317166121723733462051049833171649", "148540345782425594481812087397005917520", "332592662185978142651547833633561994572", "333477478411179154698230098409707582819", "83872791959970446940066303004490947747", "226631513623994200900713736044830703145", "334894576687285883083648593697974453771", "333446833404730724074620119875764299640", "227804690338480929301062867916928746824", "75431274063039332748128717589188211508", "261934814158887440793846442061183730228", "239299701359475614711665780422300739223", "135612542521385465026334571809290460991", "216321100620008711872814999113328172324", "224300336386691462936486166501489407248", "276730272812160626860471555819816212090", "201522100449204833755905946831838411938" ], "threshold": 0.9 }, "signature_version": "v1", "id": "CVE-2023-53333-e9c49ff0" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9bdcda7abaf22f6453e5b5efb7eb4e524095d5d8", "target": { "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Line", "deprecated": false, "digest": { "line_hashes": [ "11593223847775709853444142991544037467", "79426671346644887118789327018201784197", "285913395675500349537702435615810976086", "820477183744508266636097191440518755", "118383094947315710549425258114951859860", "123898631085769092425977731701993192826", "156444356580388781430289752830286612543", "229871836767802548960436738652631864678", "204529289387016275660550970135724605948", "215563960684099633944738103022939328303", "258075207250978468462467935209827187844", "206860140479998375326568971761185115282", "312463499335724314482354898621072405324", "218420947322252785603239713335232874604", "117831538149041431787707124745359206670", "97341317166121723733462051049833171649", "148540345782425594481812087397005917520", "332592662185978142651547833633561994572", "333477478411179154698230098409707582819", "83872791959970446940066303004490947747", "226631513623994200900713736044830703145", "334894576687285883083648593697974453771", "333446833404730724074620119875764299640", "227804690338480929301062867916928746824", "75431274063039332748128717589188211508", "261934814158887440793846442061183730228", "239299701359475614711665780422300739223", "135612542521385465026334571809290460991", "216321100620008711872814999113328172324", "224300336386691462936486166501489407248", "276730272812160626860471555819816212090", "201522100449204833755905946831838411938" ], "threshold": 0.9 }, "signature_version": "v1", "id": "CVE-2023-53333-ea1ca343" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26bd1f210d3783a691052c51d76bb8a8bbd24c67", "target": { "function": "nf_conntrack_dccp_packet", "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Function", "deprecated": false, "digest": { "function_hash": "306697854976232845563512950578739088264", "length": 2453.0 }, "signature_version": "v1", "id": "CVE-2023-53333-ed7bb3db" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c618daa5038712c4a4ef8923905a2ea1b8836a1", "target": { "file": "net/netfilter/nf_conntrack_proto_dccp.c" }, "signature_type": "Line", "deprecated": false, "digest": { "line_hashes": [ "11593223847775709853444142991544037467", "79426671346644887118789327018201784197", "285913395675500349537702435615810976086", "820477183744508266636097191440518755", "118383094947315710549425258114951859860", "123898631085769092425977731701993192826", "156444356580388781430289752830286612543", "229871836767802548960436738652631864678", "204529289387016275660550970135724605948", "215563960684099633944738103022939328303", "258075207250978468462467935209827187844", "206860140479998375326568971761185115282", "312463499335724314482354898621072405324", "220322828966697057260372886099047632589", "167215717994580683023348643049495850151", "189584181895369343014679525373047221672", "179770806376447080049431126264291613439", "97341317166121723733462051049833171649", "148540345782425594481812087397005917520", "332592662185978142651547833633561994572", "333477478411179154698230098409707582819", "83872791959970446940066303004490947747", "226631513623994200900713736044830703145", "334894576687285883083648593697974453771", "333446833404730724074620119875764299640", "227804690338480929301062867916928746824", "75431274063039332748128717589188211508", "261934814158887440793846442061183730228", "239299701359475614711665780422300739223", "135612542521385465026334571809290460991", "216321100620008711872814999113328172324", "224300336386691462936486166501489407248", "131137606913172897702868116386074418441", "330830503981997786862380347677901787825" ], "threshold": 0.9 }, "signature_version": "v1", "id": "CVE-2023-53333-f3820bc4" } ]