In the Linux kernel, the following vulnerability has been resolved:
ipvti: fix potential slab-use-after-free in decodesession6
When ipvti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ipvti device sends IPv6 packets. As commit f855691975bb ("xfrm6: Fix the nexthdr offset in decodesession6.") showed, xfrmdecodesession was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53559.json"
}[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"154778140359665535859557685576212553552",
"30610321739691663101944362479982886827",
"171612581192775198373156710664447749712",
"265898603763351146845484675730733689627",
"115405032374363412429792689496462078198",
"188319616887934153123572864982425510246",
"71269223778267059607799365088629828796",
"45790059985142968443336688838460226722",
"141021640855125679112784344731719376200"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b4d69539fdea138af2befe08893850c89248068",
"deprecated": false,
"id": "CVE-2023-53559-099467ef",
"signature_type": "Line",
"target": {
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"154778140359665535859557685576212553552",
"30610321739691663101944362479982886827",
"171612581192775198373156710664447749712",
"265898603763351146845484675730733689627",
"115405032374363412429792689496462078198",
"188319616887934153123572864982425510246",
"71269223778267059607799365088629828796",
"45790059985142968443336688838460226722",
"141021640855125679112784344731719376200"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78e397a43e1c47321a4679cc49a6c4530bf820b9",
"deprecated": false,
"id": "CVE-2023-53559-0d2ff9e8",
"signature_type": "Line",
"target": {
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 724.0,
"function_hash": "189807452226578707974287413611630350790"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6018a266279b1a75143c7c0804dd08a5fc4c3e0b",
"deprecated": false,
"id": "CVE-2023-53559-1135a4ef",
"signature_type": "Function",
"target": {
"function": "vti_tunnel_xmit",
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 723.0,
"function_hash": "200368394223585407378025097634111501238"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d34c30442d5e53a33cde79ca163320dbe2432cbd",
"deprecated": false,
"id": "CVE-2023-53559-210d2b56",
"signature_type": "Function",
"target": {
"function": "vti_tunnel_xmit",
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"154778140359665535859557685576212553552",
"30610321739691663101944362479982886827",
"171612581192775198373156710664447749712",
"265898603763351146845484675730733689627",
"115405032374363412429792689496462078198",
"188319616887934153123572864982425510246",
"71269223778267059607799365088629828796",
"45790059985142968443336688838460226722",
"141021640855125679112784344731719376200"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b05bf5dc437f7891dd409a3eaf5058459391c7a",
"deprecated": false,
"id": "CVE-2023-53559-2a53bfa7",
"signature_type": "Line",
"target": {
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"154778140359665535859557685576212553552",
"30610321739691663101944362479982886827",
"171612581192775198373156710664447749712",
"265898603763351146845484675730733689627",
"115405032374363412429792689496462078198",
"188319616887934153123572864982425510246",
"71269223778267059607799365088629828796",
"45790059985142968443336688838460226722",
"141021640855125679112784344731719376200"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d34c30442d5e53a33cde79ca163320dbe2432cbd",
"deprecated": false,
"id": "CVE-2023-53559-3371577d",
"signature_type": "Line",
"target": {
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 723.0,
"function_hash": "200368394223585407378025097634111501238"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1e04cc2ef2c0c0866c19f5627149a76c2baae32",
"deprecated": false,
"id": "CVE-2023-53559-40923a48",
"signature_type": "Function",
"target": {
"function": "vti_tunnel_xmit",
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"154778140359665535859557685576212553552",
"30610321739691663101944362479982886827",
"171612581192775198373156710664447749712",
"265898603763351146845484675730733689627",
"115405032374363412429792689496462078198",
"188319616887934153123572864982425510246",
"71269223778267059607799365088629828796",
"45790059985142968443336688838460226722",
"141021640855125679112784344731719376200"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6018a266279b1a75143c7c0804dd08a5fc4c3e0b",
"deprecated": false,
"id": "CVE-2023-53559-4b50a8ab",
"signature_type": "Line",
"target": {
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 724.0,
"function_hash": "189807452226578707974287413611630350790"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78e397a43e1c47321a4679cc49a6c4530bf820b9",
"deprecated": false,
"id": "CVE-2023-53559-4cb79759",
"signature_type": "Function",
"target": {
"function": "vti_tunnel_xmit",
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"154778140359665535859557685576212553552",
"30610321739691663101944362479982886827",
"171612581192775198373156710664447749712",
"265898603763351146845484675730733689627",
"115405032374363412429792689496462078198",
"188319616887934153123572864982425510246",
"71269223778267059607799365088629828796",
"45790059985142968443336688838460226722",
"158808089834949164808581407518339038958"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82fb41c5de243e7dfa90f32ca58e35adaff56c1d",
"deprecated": false,
"id": "CVE-2023-53559-549cf70e",
"signature_type": "Line",
"target": {
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 723.0,
"function_hash": "200368394223585407378025097634111501238"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7dfe23659f3677c08a60a0056cda2d91a79c15ca",
"deprecated": false,
"id": "CVE-2023-53559-846e1f10",
"signature_type": "Function",
"target": {
"function": "vti_tunnel_xmit",
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 658.0,
"function_hash": "123311750136262781551116200237436958648"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82fb41c5de243e7dfa90f32ca58e35adaff56c1d",
"deprecated": false,
"id": "CVE-2023-53559-8de828ac",
"signature_type": "Function",
"target": {
"function": "vti_tunnel_xmit",
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 723.0,
"function_hash": "200368394223585407378025097634111501238"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2b05bf5dc437f7891dd409a3eaf5058459391c7a",
"deprecated": false,
"id": "CVE-2023-53559-a9be892e",
"signature_type": "Function",
"target": {
"function": "vti_tunnel_xmit",
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"154778140359665535859557685576212553552",
"30610321739691663101944362479982886827",
"171612581192775198373156710664447749712",
"265898603763351146845484675730733689627",
"115405032374363412429792689496462078198",
"188319616887934153123572864982425510246",
"71269223778267059607799365088629828796",
"45790059985142968443336688838460226722",
"141021640855125679112784344731719376200"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1e04cc2ef2c0c0866c19f5627149a76c2baae32",
"deprecated": false,
"id": "CVE-2023-53559-a9fc75a7",
"signature_type": "Line",
"target": {
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"length": 723.0,
"function_hash": "200368394223585407378025097634111501238"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b4d69539fdea138af2befe08893850c89248068",
"deprecated": false,
"id": "CVE-2023-53559-c089eedf",
"signature_type": "Function",
"target": {
"function": "vti_tunnel_xmit",
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"154778140359665535859557685576212553552",
"30610321739691663101944362479982886827",
"171612581192775198373156710664447749712",
"265898603763351146845484675730733689627",
"115405032374363412429792689496462078198",
"188319616887934153123572864982425510246",
"71269223778267059607799365088629828796",
"45790059985142968443336688838460226722",
"141021640855125679112784344731719376200"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7dfe23659f3677c08a60a0056cda2d91a79c15ca",
"deprecated": false,
"id": "CVE-2023-53559-cd3b172c",
"signature_type": "Line",
"target": {
"file": "net/ipv4/ip_vti.c"
},
"signature_version": "v1"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53559.json"