In the Linux kernel, the following vulnerability has been resolved:
lwt: Fix return values of BPF xmit ops
BPF encap ops can return different types of positive values, such like NETRXDROP, NETXMITCN, NETDEVTXBUSY, and so on, from function skbdoredirect and bpflwtxmitreroute. At the xmit hook, such return values would be treated implicitly as LWTUNNELXMITCONTINUE in ip(6)finish_output2. When this happens, skbs that have been freed would continue to the neighbor subsystem, causing use-after-free bug and kernel crashes.
To fix the incorrect behavior, skbdoredirect return values can be simply discarded, the same as tc-egress behavior. On the other hand, bpflwtxmitreroute returns useful errors to local senders, e.g. PMTU information. Thus convert its return values to avoid the conflict with LWTUNNELXMIT_CONTINUE.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29b22badb7a84b783e3a4fffca16f7768fb31205",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-0746103b",
"target": {
"function": "bpf_lwt_xmit_reroute",
"file": "net/core/lwt_bpf.c"
},
"digest": {
"length": 1928.0,
"function_hash": "61336367679492785491784942100979422689"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d68c17402442f5f494a2c3ebde5cb82f6aa9160a",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-20bcd320",
"target": {
"function": "run_lwt_bpf",
"file": "net/core/lwt_bpf.c"
},
"digest": {
"length": 757.0,
"function_hash": "313048611484489542473864915237457140398"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29b22badb7a84b783e3a4fffca16f7768fb31205",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-2335f52c",
"target": {
"function": "run_lwt_bpf",
"file": "net/core/lwt_bpf.c"
},
"digest": {
"length": 757.0,
"function_hash": "313048611484489542473864915237457140398"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65583f9e070db7bece20710cfa2e3daeb0b831d9",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-3bd60f42",
"target": {
"function": "run_lwt_bpf",
"file": "net/core/lwt_bpf.c"
},
"digest": {
"length": 757.0,
"function_hash": "313048611484489542473864915237457140398"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65583f9e070db7bece20710cfa2e3daeb0b831d9",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-42e1f52b",
"target": {
"file": "net/core/lwt_bpf.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"144100259672018024126965137212303367729",
"160705389228497428161654330579628313844",
"33758616067835354647582988076771167680",
"218663824789524892928937755198033616868",
"108024969018114403796645455801585228206",
"148081335910674318269642372577058394363",
"252740424808148363895850529641555919362",
"66857021699771640006424296690233099610",
"236787922533532396318809282803375784228",
"111895217737775482075056158578648048792"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@065d5f17096ec9161180e2c890afdff4dc6125f2",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-47fed1ce",
"target": {
"function": "run_lwt_bpf",
"file": "net/core/lwt_bpf.c"
},
"digest": {
"length": 757.0,
"function_hash": "313048611484489542473864915237457140398"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d68c17402442f5f494a2c3ebde5cb82f6aa9160a",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-487d06b9",
"target": {
"function": "bpf_lwt_xmit_reroute",
"file": "net/core/lwt_bpf.c"
},
"digest": {
"length": 1928.0,
"function_hash": "61336367679492785491784942100979422689"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a97f221651fcdc891166e9bc270e3d9bfa5a0080",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-4a364eac",
"target": {
"function": "run_lwt_bpf",
"file": "net/core/lwt_bpf.c"
},
"digest": {
"length": 757.0,
"function_hash": "313048611484489542473864915237457140398"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3f647e4b642f9f6d32795a16f92c116c138d2af",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-5d154277",
"target": {
"function": "run_lwt_bpf",
"file": "net/core/lwt_bpf.c"
},
"digest": {
"length": 757.0,
"function_hash": "313048611484489542473864915237457140398"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d68c17402442f5f494a2c3ebde5cb82f6aa9160a",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-5e7308a4",
"target": {
"file": "net/core/lwt_bpf.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"144100259672018024126965137212303367729",
"160705389228497428161654330579628313844",
"33758616067835354647582988076771167680",
"218663824789524892928937755198033616868",
"108024969018114403796645455801585228206",
"148081335910674318269642372577058394363",
"252740424808148363895850529641555919362",
"66857021699771640006424296690233099610",
"236787922533532396318809282803375784228",
"111895217737775482075056158578648048792"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a97f221651fcdc891166e9bc270e3d9bfa5a0080",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-63fed08d",
"target": {
"file": "net/core/lwt_bpf.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"144100259672018024126965137212303367729",
"160705389228497428161654330579628313844",
"33758616067835354647582988076771167680",
"218663824789524892928937755198033616868",
"108024969018114403796645455801585228206",
"148081335910674318269642372577058394363",
"252740424808148363895850529641555919362",
"66857021699771640006424296690233099610",
"236787922533532396318809282803375784228",
"111895217737775482075056158578648048792"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@65583f9e070db7bece20710cfa2e3daeb0b831d9",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-6e263bcf",
"target": {
"function": "bpf_lwt_xmit_reroute",
"file": "net/core/lwt_bpf.c"
},
"digest": {
"length": 1928.0,
"function_hash": "61336367679492785491784942100979422689"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67f8f2bae8e7ac72e09def2b667e44704c4d1ee1",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-88153076",
"target": {
"function": "run_lwt_bpf",
"file": "net/core/lwt_bpf.c"
},
"digest": {
"length": 757.0,
"function_hash": "313048611484489542473864915237457140398"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67f8f2bae8e7ac72e09def2b667e44704c4d1ee1",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-89f10359",
"target": {
"function": "bpf_lwt_xmit_reroute",
"file": "net/core/lwt_bpf.c"
},
"digest": {
"length": 1928.0,
"function_hash": "61336367679492785491784942100979422689"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3f647e4b642f9f6d32795a16f92c116c138d2af",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-9c7aa36f",
"target": {
"file": "net/core/lwt_bpf.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"144100259672018024126965137212303367729",
"160705389228497428161654330579628313844",
"33758616067835354647582988076771167680",
"218663824789524892928937755198033616868",
"108024969018114403796645455801585228206",
"148081335910674318269642372577058394363",
"252740424808148363895850529641555919362",
"66857021699771640006424296690233099610",
"236787922533532396318809282803375784228",
"111895217737775482075056158578648048792"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@29b22badb7a84b783e3a4fffca16f7768fb31205",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-9f2e57a4",
"target": {
"file": "net/core/lwt_bpf.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"144100259672018024126965137212303367729",
"160705389228497428161654330579628313844",
"33758616067835354647582988076771167680",
"218663824789524892928937755198033616868",
"108024969018114403796645455801585228206",
"148081335910674318269642372577058394363",
"252740424808148363895850529641555919362",
"66857021699771640006424296690233099610",
"236787922533532396318809282803375784228",
"111895217737775482075056158578648048792"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@065d5f17096ec9161180e2c890afdff4dc6125f2",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-ac541e11",
"target": {
"function": "bpf_lwt_xmit_reroute",
"file": "net/core/lwt_bpf.c"
},
"digest": {
"length": 1928.0,
"function_hash": "61336367679492785491784942100979422689"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e3f647e4b642f9f6d32795a16f92c116c138d2af",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-b40047e6",
"target": {
"function": "bpf_lwt_xmit_reroute",
"file": "net/core/lwt_bpf.c"
},
"digest": {
"length": 1928.0,
"function_hash": "61336367679492785491784942100979422689"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@065d5f17096ec9161180e2c890afdff4dc6125f2",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-d2611821",
"target": {
"file": "net/core/lwt_bpf.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"144100259672018024126965137212303367729",
"160705389228497428161654330579628313844",
"33758616067835354647582988076771167680",
"218663824789524892928937755198033616868",
"108024969018114403796645455801585228206",
"148081335910674318269642372577058394363",
"252740424808148363895850529641555919362",
"66857021699771640006424296690233099610",
"236787922533532396318809282803375784228",
"111895217737775482075056158578648048792"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a97f221651fcdc891166e9bc270e3d9bfa5a0080",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-e3e68f5f",
"target": {
"function": "bpf_lwt_xmit_reroute",
"file": "net/core/lwt_bpf.c"
},
"digest": {
"length": 1928.0,
"function_hash": "61336367679492785491784942100979422689"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67f8f2bae8e7ac72e09def2b667e44704c4d1ee1",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2023-53338-f69f2160",
"target": {
"file": "net/core/lwt_bpf.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"144100259672018024126965137212303367729",
"160705389228497428161654330579628313844",
"33758616067835354647582988076771167680",
"218663824789524892928937755198033616868",
"108024969018114403796645455801585228206",
"148081335910674318269642372577058394363",
"252740424808148363895850529641555919362",
"66857021699771640006424296690233099610",
"236787922533532396318809282803375784228",
"111895217737775482075056158578648048792"
]
},
"signature_type": "Line"
}
]