In the Linux kernel, the following vulnerability has been resolved:
ip6mr: Fix skbunderpanic in ip6mrcachereport()
skbuff: skbunderpanic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:192! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: ipv6addrconf addrconfdadwork RIP: 0010:skbpanic+0x152/0x1d0 Call Trace: <TASK> skbpush+0xc4/0xe0 ip6mrcachereport+0xd69/0x19b0 regvifxmit+0x406/0x690 devhardstartxmit+0x17e/0x6e0 _devqueuexmit+0x2d6a/0x3d20 vlandevhardstartxmit+0x3ab/0x5c0 devhardstartxmit+0x17e/0x6e0 _devqueuexmit+0x2d6a/0x3d20 neighconnectedoutput+0x3ed/0x570 ip6finishoutput2+0x5b5/0x1950 ip6finishoutput+0x693/0x11c0 ip6output+0x24b/0x880 NFHOOK.constprop.0+0xfd/0x530 ndiscsendskb+0x9db/0x1400 ndiscsendrs+0x12a/0x6c0 addrconfdadcompleted+0x3c9/0xea0 addrconfdadwork+0x849/0x1420 processonework+0xa22/0x16e0 workerthread+0x679/0x10c0 retfromfork+0x28/0x60 retfromfork_asm+0x11/0x20
When setup a vlan device on dev pim6reg, DAD ns packet may sent on regvifxmit(). regvifxmit() ip6mrcachereport() skbpush(skb, -skbnetworkoffset(pkt));//skbnetworkoffset(pkt) is 4 And skbpush declared as: void *skbpush(struct skbuff *skb, unsigned int len); skb->data -= len; //0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850 skb->data is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails.
[ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0438e60a00d4e335b3c36397dbf26c74b5d13ef0", "target": { "function": "ip6mr_cache_report", "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "335304616102316297891763307266616953529", "length": 1721.0 }, "id": "CVE-2023-53365-0826a804" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a96d74d1076c82a4cef02c150d9996b21354c78d", "target": { "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "106209416404018086029011617339882974434", "32051360356538370478775075062992230451", "208068371477127738173478848162371878233", "3026031082232870535870030251459498487" ], "threshold": 0.9 }, "id": "CVE-2023-53365-1619551d" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8382e7ed2d63e6c2daf6881fa091526dc6c879cd", "target": { "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "106209416404018086029011617339882974434", "32051360356538370478775075062992230451", "208068371477127738173478848162371878233", "3026031082232870535870030251459498487" ], "threshold": 0.9 }, "id": "CVE-2023-53365-17a885c6" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1bb54a21f4d9b88442f8c3307c780e2db64417e4", "target": { "function": "ip6mr_cache_report", "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "335304616102316297891763307266616953529", "length": 1721.0 }, "id": "CVE-2023-53365-35264c25" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1683124129a4263dd5bce2475bab110e95fa0346", "target": { "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "106209416404018086029011617339882974434", "32051360356538370478775075062992230451", "208068371477127738173478848162371878233", "3026031082232870535870030251459498487" ], "threshold": 0.9 }, "id": "CVE-2023-53365-38d289c4" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1683124129a4263dd5bce2475bab110e95fa0346", "target": { "function": "ip6mr_cache_report", "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "335304616102316297891763307266616953529", "length": 1721.0 }, "id": "CVE-2023-53365-7bb5cc79" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a96d74d1076c82a4cef02c150d9996b21354c78d", "target": { "function": "ip6mr_cache_report", "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "37462858906914636841668272656499464561", "length": 1654.0 }, "id": "CVE-2023-53365-7e0e41a4" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30e0191b16e8a58e4620fa3e2839ddc7b9d4281c", "target": { "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "216302715767303905692997194209248162177", "154209640340769527365885972793558580405", "177513756765760876691029679803898993258", "3026031082232870535870030251459498487" ], "threshold": 0.9 }, "id": "CVE-2023-53365-991b1dbc" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3326c711f18d18fe6e1f5d83d3a7eab07e5a1560", "target": { "function": "ip6mr_cache_report", "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "179755273844556942332979438996431589077", "length": 1811.0 }, "id": "CVE-2023-53365-aa771b48" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@30e0191b16e8a58e4620fa3e2839ddc7b9d4281c", "target": { "function": "ip6mr_cache_report", "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "179755273844556942332979438996431589077", "length": 1811.0 }, "id": "CVE-2023-53365-b82cfa94" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@691a09eecad97e745b9aa0e3918db46d020bdacb", "target": { "function": "ip6mr_cache_report", "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "179755273844556942332979438996431589077", "length": 1811.0 }, "id": "CVE-2023-53365-c6e997ef" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3326c711f18d18fe6e1f5d83d3a7eab07e5a1560", "target": { "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "216302715767303905692997194209248162177", "154209640340769527365885972793558580405", "177513756765760876691029679803898993258", "3026031082232870535870030251459498487" ], "threshold": 0.9 }, "id": "CVE-2023-53365-c9613713" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0438e60a00d4e335b3c36397dbf26c74b5d13ef0", "target": { "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "106209416404018086029011617339882974434", "32051360356538370478775075062992230451", "208068371477127738173478848162371878233", "3026031082232870535870030251459498487" ], "threshold": 0.9 }, "id": "CVE-2023-53365-e6b6ed51" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1bb54a21f4d9b88442f8c3307c780e2db64417e4", "target": { "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "106209416404018086029011617339882974434", "32051360356538370478775075062992230451", "208068371477127738173478848162371878233", "3026031082232870535870030251459498487" ], "threshold": 0.9 }, "id": "CVE-2023-53365-edb71226" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8382e7ed2d63e6c2daf6881fa091526dc6c879cd", "target": { "function": "ip6mr_cache_report", "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Function", "digest": { "function_hash": "335304616102316297891763307266616953529", "length": 1721.0 }, "id": "CVE-2023-53365-efdc54df" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@691a09eecad97e745b9aa0e3918db46d020bdacb", "target": { "file": "net/ipv6/ip6mr.c" }, "signature_version": "v1", "deprecated": false, "signature_type": "Line", "digest": { "line_hashes": [ "216302715767303905692997194209248162177", "154209640340769527365885972793558580405", "177513756765760876691029679803898993258", "3026031082232870535870030251459498487" ], "threshold": 0.9 }, "id": "CVE-2023-53365-f0fc905e" } ]