In the Linux kernel, the following vulnerability has been resolved:
skbuff: skb_segment, Call zero copy functions before using skbuff frags
Commit bf5c25d60861 ("skbuff: in skbsegment, call zerocopy functions once per nskb") added the call to zero copy functions in skbsegment(). The change introduced a bug in skbsegment() because skborphan_frags() may possibly change the number of fragments or allocate new fragments altogether leaving nrfrags and frag to point to the old values. This can cause a panic with stacktrace like the one below.
[ 193.894380] BUG: kernel NULL pointer dereference, address: 00000000000000bc [ 193.895273] CPU: 13 PID: 18164 Comm: vh-net-17428 Kdump: loaded Tainted: G O 5.15.123+ #26 [ 193.903919] RIP: 0010:skbsegment+0xb0e/0x12f0 [ 194.021892] Call Trace: [ 194.027422] <TASK> [ 194.072861] tcpgsosegment+0x107/0x540 [ 194.082031] inetgsosegment+0x15c/0x3d0 [ 194.090783] skbmacgsosegment+0x9f/0x110 [ 194.095016] _skbgsosegment+0xc1/0x190 [ 194.103131] netemenqueue+0x290/0xb10 [schnetem] [ 194.107071] devqdiscenqueue+0x16/0x70 [ 194.110884] _devqueuexmit+0x63b/0xb30 [ 194.121670] bondstartxmit+0x159/0x380 [bonding] [ 194.128506] devhardstartxmit+0xc3/0x1e0 [ 194.131787] _devqueuexmit+0x8a0/0xb30 [ 194.138225] macvlanstartxmit+0x4f/0x100 [macvlan] [ 194.141477] devhardstartxmit+0xc3/0x1e0 [ 194.144622] schdirectxmit+0xe3/0x280 [ 194.147748] _devqueuexmit+0x54a/0xb30 [ 194.154131] tapgetuser+0x2a8/0x9c0 [tap] [ 194.157358] tapsendmsg+0x52/0x8e0 [tap] [ 194.167049] handletxzerocopy+0x14e/0x4c0 [vhostnet] [ 194.173631] handletx+0xcd/0xe0 [vhostnet] [ 194.176959] vhostworker+0x76/0xb0 [vhost] [ 194.183667] kthread+0x118/0x140 [ 194.190358] retfrom_fork+0x1f/0x30 [ 194.193670] </TASK>
In this case calling skborphanfrags() updated nrfrags leaving nrfrags local variable in skbsegment() stale. This resulted in the code hitting i >= nrfrags prematurely and trying to move to next fragskb using listskb pointer, which was NULL, and caused kernel panic. Move the call to zero copy functions before using frags and nr_frags.
[
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171346367111656471741378181550924581836",
"154027342495950670406429439402474177677",
"250199857800967146736616935082451964532",
"313340414554838112396255487462995130124",
"83615314664116244028255588901680528889",
"129479078897551711886246227407683930009",
"59004375315478795398546406261622397714",
"191283136931282038721702664978610299946",
"222501924605310597420789305221218576159",
"314383335985640827417559599756718770688",
"91392264582746149863374056790177926278",
"293673407902408509329875139664297807043",
"336625654209980644727051906594223279103",
"338522314119954487493266174761506768508",
"326103138544083048221482473487824669201",
"269971516283087882567867459659388398444",
"132786410291477918277665625039510866245",
"163348580831284015379363909320751494932",
"98830324063341242438077796705574158793",
"83528018363032497956543980620130106627",
"219885216191531510257631318598494507607",
"40195748341771458533965349190008123163",
"304003435146423996812989990520711660006",
"334432552438799177092792816680580937779",
"167297483919367053473686912719591469050",
"149661841792339855293336661179240742059",
"239634104709278963739533686549498927254",
"9684202274848583245352169522647112113",
"324542721483998878106207961488557075631",
"187870324146284352328734598123329230443",
"43786936456227951910213470982370522374",
"210406225480116035607224458764670961214",
"264048645373396414296803718409796875166",
"175375250898819582801259292644259681115",
"49808911417639419341195827517761785065",
"211339145374765731020395391761593780138",
"164035489537389678131342709920598731739",
"317845601930136075283026333071917839662",
"277381838490682237005538665519071611708",
"301395570844446130075645235762896833980",
"169647792188527179565285087591767428604",
"135934152046582794228659989352768383197",
"92550770569566745838800773337900069938",
"4448046140741499085948876690917341097",
"306578467127565671130341423907789312844",
"310470509378632540497722326305203050527"
]
},
"target": {
"file": "net/core/skbuff.c"
},
"signature_version": "v1",
"id": "CVE-2023-53354-012f317d",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5790386595d06ea9decfd9ba5f1ea48cf09aa02"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "1851972365996159664735855067680824419",
"length": 5883.0
},
"target": {
"file": "net/core/skbuff.c",
"function": "skb_segment"
},
"signature_version": "v1",
"id": "CVE-2023-53354-05e84489",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c26ed3c6abe86ddab0510529000b970b05c9b40"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171346367111656471741378181550924581836",
"154027342495950670406429439402474177677",
"250199857800967146736616935082451964532",
"313340414554838112396255487462995130124",
"83615314664116244028255588901680528889",
"129479078897551711886246227407683930009",
"59004375315478795398546406261622397714",
"191283136931282038721702664978610299946",
"222501924605310597420789305221218576159",
"314383335985640827417559599756718770688",
"91392264582746149863374056790177926278",
"293673407902408509329875139664297807043",
"336625654209980644727051906594223279103",
"338522314119954487493266174761506768508",
"326103138544083048221482473487824669201",
"6086081412069858895464425294180443803",
"309411181004276660031249418036017916548",
"653717429070206131577041299844160507",
"98830324063341242438077796705574158793",
"83528018363032497956543980620130106627",
"219885216191531510257631318598494507607",
"330470210511524201982415816573681059309",
"304003435146423996812989990520711660006",
"334432552438799177092792816680580937779",
"167297483919367053473686912719591469050",
"149661841792339855293336661179240742059",
"239634104709278963739533686549498927254",
"9684202274848583245352169522647112113",
"324542721483998878106207961488557075631",
"187870324146284352328734598123329230443",
"43786936456227951910213470982370522374",
"168896871279466898225443248434467577172",
"19791904442777444755434393793499210207",
"137346728158842821227530035322644521876",
"49808911417639419341195827517761785065",
"211339145374765731020395391761593780138",
"164035489537389678131342709920598731739",
"317845601930136075283026333071917839662",
"277381838490682237005538665519071611708",
"301395570844446130075645235762896833980",
"169647792188527179565285087591767428604",
"135934152046582794228659989352768383197",
"92550770569566745838800773337900069938",
"4448046140741499085948876690917341097",
"306578467127565671130341423907789312844",
"310470509378632540497722326305203050527"
]
},
"target": {
"file": "net/core/skbuff.c"
},
"signature_version": "v1",
"id": "CVE-2023-53354-1696ebc7",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d44403ec0676317b7f7edf2a035bb219fee3304e"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171346367111656471741378181550924581836",
"154027342495950670406429439402474177677",
"250199857800967146736616935082451964532",
"313340414554838112396255487462995130124",
"83615314664116244028255588901680528889",
"129479078897551711886246227407683930009",
"59004375315478795398546406261622397714",
"191283136931282038721702664978610299946",
"222501924605310597420789305221218576159",
"314383335985640827417559599756718770688",
"91392264582746149863374056790177926278",
"293673407902408509329875139664297807043",
"336625654209980644727051906594223279103",
"338522314119954487493266174761506768508",
"326103138544083048221482473487824669201",
"269971516283087882567867459659388398444",
"132786410291477918277665625039510866245",
"163348580831284015379363909320751494932",
"98830324063341242438077796705574158793",
"83528018363032497956543980620130106627",
"219885216191531510257631318598494507607",
"330470210511524201982415816573681059309",
"304003435146423996812989990520711660006",
"334432552438799177092792816680580937779",
"167297483919367053473686912719591469050",
"149661841792339855293336661179240742059",
"239634104709278963739533686549498927254",
"9684202274848583245352169522647112113",
"324542721483998878106207961488557075631",
"187870324146284352328734598123329230443",
"43786936456227951910213470982370522374",
"168896871279466898225443248434467577172",
"19791904442777444755434393793499210207",
"137346728158842821227530035322644521876",
"49808911417639419341195827517761785065",
"211339145374765731020395391761593780138",
"164035489537389678131342709920598731739",
"317845601930136075283026333071917839662",
"277381838490682237005538665519071611708",
"301395570844446130075645235762896833980",
"169647792188527179565285087591767428604",
"135934152046582794228659989352768383197",
"92550770569566745838800773337900069938",
"4448046140741499085948876690917341097",
"306578467127565671130341423907789312844",
"310470509378632540497722326305203050527"
]
},
"target": {
"file": "net/core/skbuff.c"
},
"signature_version": "v1",
"id": "CVE-2023-53354-2c57b8d5",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8836c266201c29a5acb4f582227686f47b65ad61"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "136903019793860368523535760149914780544",
"length": 5803.0
},
"target": {
"file": "net/core/skbuff.c",
"function": "skb_segment"
},
"signature_version": "v1",
"id": "CVE-2023-53354-3e8ab6e8",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d44403ec0676317b7f7edf2a035bb219fee3304e"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "1851972365996159664735855067680824419",
"length": 5883.0
},
"target": {
"file": "net/core/skbuff.c",
"function": "skb_segment"
},
"signature_version": "v1",
"id": "CVE-2023-53354-4e861c85",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d5790386595d06ea9decfd9ba5f1ea48cf09aa02"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171346367111656471741378181550924581836",
"154027342495950670406429439402474177677",
"250199857800967146736616935082451964532",
"313340414554838112396255487462995130124",
"83615314664116244028255588901680528889",
"129479078897551711886246227407683930009",
"59004375315478795398546406261622397714",
"191283136931282038721702664978610299946",
"222501924605310597420789305221218576159",
"314383335985640827417559599756718770688",
"91392264582746149863374056790177926278",
"293673407902408509329875139664297807043",
"336625654209980644727051906594223279103",
"338522314119954487493266174761506768508",
"326103138544083048221482473487824669201",
"6086081412069858895464425294180443803",
"309411181004276660031249418036017916548",
"653717429070206131577041299844160507",
"98830324063341242438077796705574158793",
"83528018363032497956543980620130106627",
"219885216191531510257631318598494507607",
"330470210511524201982415816573681059309",
"304003435146423996812989990520711660006",
"334432552438799177092792816680580937779",
"167297483919367053473686912719591469050",
"149661841792339855293336661179240742059",
"239634104709278963739533686549498927254",
"9684202274848583245352169522647112113",
"324542721483998878106207961488557075631",
"187870324146284352328734598123329230443",
"43786936456227951910213470982370522374",
"168896871279466898225443248434467577172",
"19791904442777444755434393793499210207",
"137346728158842821227530035322644521876",
"49808911417639419341195827517761785065",
"211339145374765731020395391761593780138",
"164035489537389678131342709920598731739",
"317845601930136075283026333071917839662",
"277381838490682237005538665519071611708",
"301395570844446130075645235762896833980",
"169647792188527179565285087591767428604",
"135934152046582794228659989352768383197",
"92550770569566745838800773337900069938",
"4448046140741499085948876690917341097",
"306578467127565671130341423907789312844",
"310470509378632540497722326305203050527"
]
},
"target": {
"file": "net/core/skbuff.c"
},
"signature_version": "v1",
"id": "CVE-2023-53354-5aef9718",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fcab3f661dbfd88e27ddbbe65368f3fa2d823175"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171346367111656471741378181550924581836",
"154027342495950670406429439402474177677",
"250199857800967146736616935082451964532",
"313340414554838112396255487462995130124",
"83615314664116244028255588901680528889",
"129479078897551711886246227407683930009",
"59004375315478795398546406261622397714",
"191283136931282038721702664978610299946",
"222501924605310597420789305221218576159",
"314383335985640827417559599756718770688",
"91392264582746149863374056790177926278",
"293673407902408509329875139664297807043",
"336625654209980644727051906594223279103",
"338522314119954487493266174761506768508",
"326103138544083048221482473487824669201",
"269971516283087882567867459659388398444",
"132786410291477918277665625039510866245",
"163348580831284015379363909320751494932",
"98830324063341242438077796705574158793",
"83528018363032497956543980620130106627",
"219885216191531510257631318598494507607",
"40195748341771458533965349190008123163",
"304003435146423996812989990520711660006",
"334432552438799177092792816680580937779",
"167297483919367053473686912719591469050",
"149661841792339855293336661179240742059",
"239634104709278963739533686549498927254",
"9684202274848583245352169522647112113",
"324542721483998878106207961488557075631",
"187870324146284352328734598123329230443",
"43786936456227951910213470982370522374",
"210406225480116035607224458764670961214",
"264048645373396414296803718409796875166",
"175375250898819582801259292644259681115",
"49808911417639419341195827517761785065",
"211339145374765731020395391761593780138",
"164035489537389678131342709920598731739",
"317845601930136075283026333071917839662",
"277381838490682237005538665519071611708",
"301395570844446130075645235762896833980",
"169647792188527179565285087591767428604",
"135934152046582794228659989352768383197",
"92550770569566745838800773337900069938",
"4448046140741499085948876690917341097",
"306578467127565671130341423907789312844",
"310470509378632540497722326305203050527"
]
},
"target": {
"file": "net/core/skbuff.c"
},
"signature_version": "v1",
"id": "CVE-2023-53354-697fb981",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ea35288c83b3d501a88bc17f2df8f176b5cc96f"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171346367111656471741378181550924581836",
"154027342495950670406429439402474177677",
"250199857800967146736616935082451964532",
"313340414554838112396255487462995130124",
"83615314664116244028255588901680528889",
"129479078897551711886246227407683930009",
"59004375315478795398546406261622397714",
"191283136931282038721702664978610299946",
"222501924605310597420789305221218576159",
"314383335985640827417559599756718770688",
"91392264582746149863374056790177926278",
"293673407902408509329875139664297807043",
"336625654209980644727051906594223279103",
"338522314119954487493266174761506768508",
"326103138544083048221482473487824669201",
"269971516283087882567867459659388398444",
"132786410291477918277665625039510866245",
"163348580831284015379363909320751494932",
"98830324063341242438077796705574158793",
"83528018363032497956543980620130106627",
"219885216191531510257631318598494507607",
"40195748341771458533965349190008123163",
"304003435146423996812989990520711660006",
"334432552438799177092792816680580937779",
"167297483919367053473686912719591469050",
"149661841792339855293336661179240742059",
"239634104709278963739533686549498927254",
"9684202274848583245352169522647112113",
"324542721483998878106207961488557075631",
"187870324146284352328734598123329230443",
"43786936456227951910213470982370522374",
"210406225480116035607224458764670961214",
"264048645373396414296803718409796875166",
"175375250898819582801259292644259681115",
"49808911417639419341195827517761785065",
"211339145374765731020395391761593780138",
"164035489537389678131342709920598731739",
"317845601930136075283026333071917839662",
"277381838490682237005538665519071611708",
"301395570844446130075645235762896833980",
"169647792188527179565285087591767428604",
"135934152046582794228659989352768383197",
"92550770569566745838800773337900069938",
"4448046140741499085948876690917341097",
"306578467127565671130341423907789312844",
"310470509378632540497722326305203050527"
]
},
"target": {
"file": "net/core/skbuff.c"
},
"signature_version": "v1",
"id": "CVE-2023-53354-74097273",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f99006e840a4dbc8f5a34cecc6b5b26c73ef49bb"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171346367111656471741378181550924581836",
"154027342495950670406429439402474177677",
"250199857800967146736616935082451964532",
"313340414554838112396255487462995130124",
"83615314664116244028255588901680528889",
"129479078897551711886246227407683930009",
"59004375315478795398546406261622397714",
"191283136931282038721702664978610299946",
"222501924605310597420789305221218576159",
"314383335985640827417559599756718770688",
"91392264582746149863374056790177926278",
"293673407902408509329875139664297807043",
"336625654209980644727051906594223279103",
"338522314119954487493266174761506768508",
"326103138544083048221482473487824669201",
"269971516283087882567867459659388398444",
"132786410291477918277665625039510866245",
"163348580831284015379363909320751494932",
"98830324063341242438077796705574158793",
"83528018363032497956543980620130106627",
"219885216191531510257631318598494507607",
"40195748341771458533965349190008123163",
"304003435146423996812989990520711660006",
"334432552438799177092792816680580937779",
"167297483919367053473686912719591469050",
"149661841792339855293336661179240742059",
"239634104709278963739533686549498927254",
"9684202274848583245352169522647112113",
"324542721483998878106207961488557075631",
"187870324146284352328734598123329230443",
"43786936456227951910213470982370522374",
"210406225480116035607224458764670961214",
"264048645373396414296803718409796875166",
"175375250898819582801259292644259681115",
"49808911417639419341195827517761785065",
"211339145374765731020395391761593780138",
"164035489537389678131342709920598731739",
"317845601930136075283026333071917839662",
"277381838490682237005538665519071611708",
"301395570844446130075645235762896833980",
"169647792188527179565285087591767428604",
"135934152046582794228659989352768383197",
"92550770569566745838800773337900069938",
"4448046140741499085948876690917341097",
"306578467127565671130341423907789312844",
"310470509378632540497722326305203050527"
]
},
"target": {
"file": "net/core/skbuff.c"
},
"signature_version": "v1",
"id": "CVE-2023-53354-7a30a549",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6c26ed3c6abe86ddab0510529000b970b05c9b40"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "296011107181799879747657262012166737101",
"length": 5806.0
},
"target": {
"file": "net/core/skbuff.c",
"function": "skb_segment"
},
"signature_version": "v1",
"id": "CVE-2023-53354-99b8f2a0",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fcab3f661dbfd88e27ddbbe65368f3fa2d823175"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"171346367111656471741378181550924581836",
"154027342495950670406429439402474177677",
"250199857800967146736616935082451964532",
"313340414554838112396255487462995130124",
"83615314664116244028255588901680528889",
"129479078897551711886246227407683930009",
"59004375315478795398546406261622397714",
"191283136931282038721702664978610299946",
"222501924605310597420789305221218576159",
"314383335985640827417559599756718770688",
"91392264582746149863374056790177926278",
"293673407902408509329875139664297807043",
"336625654209980644727051906594223279103",
"338522314119954487493266174761506768508",
"326103138544083048221482473487824669201",
"269971516283087882567867459659388398444",
"132786410291477918277665625039510866245",
"163348580831284015379363909320751494932",
"98830324063341242438077796705574158793",
"83528018363032497956543980620130106627",
"219885216191531510257631318598494507607",
"40195748341771458533965349190008123163",
"304003435146423996812989990520711660006",
"334432552438799177092792816680580937779",
"167297483919367053473686912719591469050",
"149661841792339855293336661179240742059",
"239634104709278963739533686549498927254",
"9684202274848583245352169522647112113",
"324542721483998878106207961488557075631",
"187870324146284352328734598123329230443",
"43786936456227951910213470982370522374",
"210406225480116035607224458764670961214",
"264048645373396414296803718409796875166",
"175375250898819582801259292644259681115",
"49808911417639419341195827517761785065",
"211339145374765731020395391761593780138",
"164035489537389678131342709920598731739",
"317845601930136075283026333071917839662",
"277381838490682237005538665519071611708",
"301395570844446130075645235762896833980",
"169647792188527179565285087591767428604",
"135934152046582794228659989352768383197",
"92550770569566745838800773337900069938",
"4448046140741499085948876690917341097",
"306578467127565671130341423907789312844",
"310470509378632540497722326305203050527"
]
},
"target": {
"file": "net/core/skbuff.c"
},
"signature_version": "v1",
"id": "CVE-2023-53354-9b76045c",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04c3eee4e13f60bf6f9a366ad39f88a01a57166e"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "135758203247688196559981253639282001021",
"length": 5886.0
},
"target": {
"file": "net/core/skbuff.c",
"function": "skb_segment"
},
"signature_version": "v1",
"id": "CVE-2023-53354-ad30b017",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8836c266201c29a5acb4f582227686f47b65ad61"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "1851972365996159664735855067680824419",
"length": 5883.0
},
"target": {
"file": "net/core/skbuff.c",
"function": "skb_segment"
},
"signature_version": "v1",
"id": "CVE-2023-53354-b8c33454",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f99006e840a4dbc8f5a34cecc6b5b26c73ef49bb"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "1851972365996159664735855067680824419",
"length": 5883.0
},
"target": {
"file": "net/core/skbuff.c",
"function": "skb_segment"
},
"signature_version": "v1",
"id": "CVE-2023-53354-bb1886db",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2ea35288c83b3d501a88bc17f2df8f176b5cc96f"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "1851972365996159664735855067680824419",
"length": 5883.0
},
"target": {
"file": "net/core/skbuff.c",
"function": "skb_segment"
},
"signature_version": "v1",
"id": "CVE-2023-53354-ca590c51",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@04c3eee4e13f60bf6f9a366ad39f88a01a57166e"
}
]