In the Linux kernel, the following vulnerability has been resolved:
ip6mr: Fix skbunderpanic in ip6mrcachereport()
skbuff: skbunderpanic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:192! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: ipv6addrconf addrconfdadwork RIP: 0010:skbpanic+0x152/0x1d0 Call Trace: <TASK> skbpush+0xc4/0xe0 ip6mrcachereport+0xd69/0x19b0 regvifxmit+0x406/0x690 devhardstartxmit+0x17e/0x6e0 _devqueuexmit+0x2d6a/0x3d20 vlandevhardstartxmit+0x3ab/0x5c0 devhardstartxmit+0x17e/0x6e0 _devqueuexmit+0x2d6a/0x3d20 neighconnectedoutput+0x3ed/0x570 ip6finishoutput2+0x5b5/0x1950 ip6finishoutput+0x693/0x11c0 ip6output+0x24b/0x880 NFHOOK.constprop.0+0xfd/0x530 ndiscsendskb+0x9db/0x1400 ndiscsendrs+0x12a/0x6c0 addrconfdadcompleted+0x3c9/0xea0 addrconfdadwork+0x849/0x1420 processonework+0xa22/0x16e0 workerthread+0x679/0x10c0 retfromfork+0x28/0x60 retfromfork_asm+0x11/0x20
When setup a vlan device on dev pim6reg, DAD ns packet may sent on regvifxmit(). regvifxmit() ip6mrcachereport() skbpush(skb, -skbnetworkoffset(pkt));//skbnetworkoffset(pkt) is 4 And skbpush declared as: void *skbpush(struct skbuff *skb, unsigned int len); skb->data -= len; //0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850 skb->data is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53365.json",
"cna_assigner": "Linux"
}[
{
"id": "CVE-2023-53365-0826a804",
"signature_version": "v1",
"digest": {
"function_hash": "335304616102316297891763307266616953529",
"length": 1721.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0438e60a00d4e335b3c36397dbf26c74b5d13ef0",
"signature_type": "Function",
"target": {
"file": "net/ipv6/ip6mr.c",
"function": "ip6mr_cache_report"
}
},
{
"id": "CVE-2023-53365-1619551d",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"106209416404018086029011617339882974434",
"32051360356538370478775075062992230451",
"208068371477127738173478848162371878233",
"3026031082232870535870030251459498487"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a96d74d1076c82a4cef02c150d9996b21354c78d",
"signature_type": "Line",
"target": {
"file": "net/ipv6/ip6mr.c"
}
},
{
"id": "CVE-2023-53365-35264c25",
"signature_version": "v1",
"digest": {
"function_hash": "335304616102316297891763307266616953529",
"length": 1721.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1bb54a21f4d9b88442f8c3307c780e2db64417e4",
"signature_type": "Function",
"target": {
"file": "net/ipv6/ip6mr.c",
"function": "ip6mr_cache_report"
}
},
{
"id": "CVE-2023-53365-38d289c4",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"106209416404018086029011617339882974434",
"32051360356538370478775075062992230451",
"208068371477127738173478848162371878233",
"3026031082232870535870030251459498487"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1683124129a4263dd5bce2475bab110e95fa0346",
"signature_type": "Line",
"target": {
"file": "net/ipv6/ip6mr.c"
}
},
{
"id": "CVE-2023-53365-7bb5cc79",
"signature_version": "v1",
"digest": {
"function_hash": "335304616102316297891763307266616953529",
"length": 1721.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1683124129a4263dd5bce2475bab110e95fa0346",
"signature_type": "Function",
"target": {
"file": "net/ipv6/ip6mr.c",
"function": "ip6mr_cache_report"
}
},
{
"id": "CVE-2023-53365-7e0e41a4",
"signature_version": "v1",
"digest": {
"function_hash": "37462858906914636841668272656499464561",
"length": 1654.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a96d74d1076c82a4cef02c150d9996b21354c78d",
"signature_type": "Function",
"target": {
"file": "net/ipv6/ip6mr.c",
"function": "ip6mr_cache_report"
}
},
{
"id": "CVE-2023-53365-991b1dbc",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"216302715767303905692997194209248162177",
"154209640340769527365885972793558580405",
"177513756765760876691029679803898993258",
"3026031082232870535870030251459498487"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30e0191b16e8a58e4620fa3e2839ddc7b9d4281c",
"signature_type": "Line",
"target": {
"file": "net/ipv6/ip6mr.c"
}
},
{
"id": "CVE-2023-53365-aa771b48",
"signature_version": "v1",
"digest": {
"function_hash": "179755273844556942332979438996431589077",
"length": 1811.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3326c711f18d18fe6e1f5d83d3a7eab07e5a1560",
"signature_type": "Function",
"target": {
"file": "net/ipv6/ip6mr.c",
"function": "ip6mr_cache_report"
}
},
{
"id": "CVE-2023-53365-b82cfa94",
"signature_version": "v1",
"digest": {
"function_hash": "179755273844556942332979438996431589077",
"length": 1811.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30e0191b16e8a58e4620fa3e2839ddc7b9d4281c",
"signature_type": "Function",
"target": {
"file": "net/ipv6/ip6mr.c",
"function": "ip6mr_cache_report"
}
},
{
"id": "CVE-2023-53365-c9613713",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"216302715767303905692997194209248162177",
"154209640340769527365885972793558580405",
"177513756765760876691029679803898993258",
"3026031082232870535870030251459498487"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3326c711f18d18fe6e1f5d83d3a7eab07e5a1560",
"signature_type": "Line",
"target": {
"file": "net/ipv6/ip6mr.c"
}
},
{
"id": "CVE-2023-53365-e6b6ed51",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"106209416404018086029011617339882974434",
"32051360356538370478775075062992230451",
"208068371477127738173478848162371878233",
"3026031082232870535870030251459498487"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0438e60a00d4e335b3c36397dbf26c74b5d13ef0",
"signature_type": "Line",
"target": {
"file": "net/ipv6/ip6mr.c"
}
},
{
"id": "CVE-2023-53365-edb71226",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"106209416404018086029011617339882974434",
"32051360356538370478775075062992230451",
"208068371477127738173478848162371878233",
"3026031082232870535870030251459498487"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1bb54a21f4d9b88442f8c3307c780e2db64417e4",
"signature_type": "Line",
"target": {
"file": "net/ipv6/ip6mr.c"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53365.json"