CVE-2023-53585

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-53585

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53585.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-53585

Downstream

BELL-CVE-2023-53585

DEBIAN-CVE-2023-53585

RHSA-2020:4431

RHSA-2024:2394

SUSE-SU-2025:4057-1

SUSE-SU-2025:4128-1

SUSE-SU-2025:4132-1

SUSE-SU-2025:4301-1

UBUNTU-CVE-2023-53585

Related

Published

2025-10-04T15:44:01.022Z

Modified

2026-02-21T00:36:44.811155Z

Summary

bpf: reject unhashed sockets in bpf_sk_assign

Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: reject unhashed sockets in bpfskassign

The semantics for bpfskassign are as follows:

sk = some_lookup_func()
bpf_sk_assign(skb, sk)
bpf_sk_release(sk)

That is, the sk is not consumed by bpfskassign. The function therefore needs to make sure that sk lives long enough to be consumed from _inetlookup_skb. The path through the stack for a TCPv4 packet is roughly:

netifreceiveskbcore: takes RCU read lock _netifreceiveskbcore: schhandleingress: tcfclassify: bpfskassign() deliverptypelistskb: deliverskb: ippackettype->func == iprcv: iprcvcore: iprcvfinishcore: dstinput: iplocaldeliver: iplocaldeliverfinish: ipprotocoldeliverrcu: tcpv4rcv: _inetlookupskb: skbstealsock

The existing helper takes advantage of the fact that everything happens in the same RCU critical section: for sockets with SOCKRCUFREE set bpfskassign never takes a reference. skbstealsock then checks SOCKRCUFREE again and does sock_put if necessary.

This approach assumes that SOCKRCUFREE is never set on a sk between bpfskassign and skbstealsock, but this invariant is violated by unhashed UDP sockets. A new UDP socket is created in TCPCLOSE state but without SOCKRCUFREE set. That flag is only added in udplibgetport() which happens when a socket is bound.

When bpfskassign was added it wasn't possible to access unhashed UDP sockets from BPF, so this wasn't a problem. This changed in commit 0c48eefae712 ("sock_map: Lift socket state restriction for datagram sockets"), but the helper wasn't adjusted accordingly. The following sequence of events will therefore lead to a refcount leak:

Add socket(AFINET, SOCKDGRAM) to a sockmap.
Pull socket out of sockmap and bpfskassign it. Since SOCKRCUFREE is not set we increment the refcount.
bind() or connect() the socket, setting SOCKRCUFREE.
skbstealsock will now set refcounted = false due to SOCKRCUFREE.
tcpv4rcv() skips sock_put().

Fix the problem by rejecting unhashed sockets in bpfskassign(). This matches the behaviour of _inetlookupskb which is ultimately the goal of bpfsk_assign().

Database specific

{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53585.json"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449

Fixed

791a12102e5191dcb6ce0b3a99d71b5a2802d12a

Fixed

7dcbc0bb0e5cc1823923744befce59ac353135e6

Fixed

c0ce0fb76610d5fad31f56f2ca8241a2a6717a1b

Fixed

8aa43cfbb68b25119d2ced14ec717173e2901fa2

Fixed

3d4522f59fb748a54446846522941a4f09da63e9

Fixed

67312adc96b5a585970d03b62412847afe2c6b01

Affected versions

v5.*

v5.10

v5.10-rc1

v5.10-rc2

v5.10-rc3

v5.10-rc4

v5.10-rc5

v5.10-rc6

v5.10-rc7

v5.10.1

v5.10.10

v5.10.100

v5.10.101

v5.10.102

v5.10.103

v5.10.104

v5.10.105

v5.10.106

v5.10.107

v5.10.108

v5.10.109

v5.10.11

v5.10.110

v5.10.111

v5.10.112

v5.10.113

v5.10.114

v5.10.115

v5.10.116

v5.10.117

v5.10.118

v5.10.119

v5.10.12

v5.10.120

v5.10.121

v5.10.122

v5.10.123

v5.10.124

v5.10.125

v5.10.126

v5.10.127

v5.10.128

v5.10.129

v5.10.13

v5.10.130

v5.10.131

v5.10.132

v5.10.133

v5.10.134

v5.10.135

v5.10.136

v5.10.137

v5.10.138

v5.10.139

v5.10.14

v5.10.140

v5.10.141

v5.10.142

v5.10.143

v5.10.144

v5.10.145

v5.10.146

v5.10.147

v5.10.148

v5.10.149

v5.10.15

v5.10.150

v5.10.151

v5.10.152

v5.10.153

v5.10.154

v5.10.155

v5.10.156

v5.10.157

v5.10.158

v5.10.159

v5.10.16

v5.10.160

v5.10.161

v5.10.162

v5.10.163

v5.10.164

v5.10.165

v5.10.166

v5.10.167

v5.10.168

v5.10.169

v5.10.17

v5.10.170

v5.10.171

v5.10.172

v5.10.173

v5.10.174

v5.10.175

v5.10.176

v5.10.177

v5.10.178

v5.10.179

v5.10.18

v5.10.180

v5.10.181

v5.10.182

v5.10.183

v5.10.184

v5.10.185

v5.10.186

v5.10.187

v5.10.188

v5.10.189

v5.10.19

v5.10.190

v5.10.191

v5.10.192

v5.10.193

v5.10.194

v5.10.2

v5.10.20

v5.10.21

v5.10.22

v5.10.23

v5.10.24

v5.10.25

v5.10.26

v5.10.27

v5.10.28

v5.10.29

v5.10.3

v5.10.30

v5.10.31

v5.10.32

v5.10.33

v5.10.34

v5.10.35

v5.10.36

v5.10.37

v5.10.38

v5.10.39

v5.10.4

v5.10.40

v5.10.41

v5.10.42

v5.10.43

v5.10.44

v5.10.45

v5.10.46

v5.10.47

v5.10.48

v5.10.49

v5.10.5

v5.10.50

v5.10.51

v5.10.52

v5.10.53

v5.10.54

v5.10.55

v5.10.56

v5.10.57

v5.10.58

v5.10.59

v5.10.6

v5.10.60

v5.10.61

v5.10.62

v5.10.63

v5.10.64

v5.10.65

v5.10.66

v5.10.67

v5.10.68

v5.10.69

v5.10.7

v5.10.70

v5.10.71

v5.10.72

v5.10.73

v5.10.74

v5.10.75

v5.10.76

v5.10.77

v5.10.78

v5.10.79

v5.10.8

v5.10.80

v5.10.81

v5.10.82

v5.10.83

v5.10.84

v5.10.85

v5.10.86

v5.10.87

v5.10.88

v5.10.89

v5.10.9

v5.10.90

v5.10.91

v5.10.92

v5.10.93

v5.10.94

v5.10.95

v5.10.96

v5.10.97

v5.10.98

v5.10.99

v5.11

v5.11-rc1

v5.11-rc2

v5.11-rc3

v5.11-rc4

v5.11-rc5

v5.11-rc6

v5.11-rc7

v5.12

v5.12-rc1

v5.12-rc1-dontuse

v5.12-rc2

v5.12-rc3

v5.12-rc4

v5.12-rc5

v5.12-rc6

v5.12-rc7

v5.12-rc8

v5.13

v5.13-rc1

v5.13-rc2

v5.13-rc3

v5.13-rc4

v5.13-rc5

v5.13-rc6

v5.13-rc7

v5.14

v5.14-rc1

v5.14-rc2

v5.14-rc3

v5.14-rc4

v5.14-rc5

v5.14-rc6

v5.14-rc7

v5.15

v5.15-rc1

v5.15-rc2

v5.15-rc3

v5.15-rc4

v5.15-rc5

v5.15-rc6

v5.15-rc7

v5.15.1

v5.15.10

v5.15.100

v5.15.101

v5.15.102

v5.15.103

v5.15.104

v5.15.105

v5.15.106

v5.15.107

v5.15.108

v5.15.109

v5.15.11

v5.15.110

v5.15.111

v5.15.112

v5.15.113

v5.15.114

v5.15.115

v5.15.116

v5.15.117

v5.15.118

v5.15.119

v5.15.12

v5.15.120

v5.15.121

v5.15.122

v5.15.123

v5.15.124

v5.15.125

v5.15.126

v5.15.127

v5.15.128

v5.15.129

v5.15.13

v5.15.130

v5.15.131

v5.15.14

v5.15.15

v5.15.16

v5.15.17

v5.15.18

v5.15.19

v5.15.2

v5.15.20

v5.15.21

v5.15.22

v5.15.23

v5.15.24

v5.15.25

v5.15.26

v5.15.27

v5.15.28

v5.15.29

v5.15.3

v5.15.30

v5.15.31

v5.15.32

v5.15.33

v5.15.34

v5.15.35

v5.15.36

v5.15.37

v5.15.38

v5.15.39

v5.15.4

v5.15.40

v5.15.41

v5.15.42

v5.15.43

v5.15.44

v5.15.45

v5.15.46

v5.15.47

v5.15.48

v5.15.49

v5.15.5

v5.15.50

v5.15.51

v5.15.52

v5.15.53

v5.15.54

v5.15.55

v5.15.56

v5.15.57

v5.15.58

v5.15.59

v5.15.6

v5.15.60

v5.15.61

v5.15.62

v5.15.63

v5.15.64

v5.15.65

v5.15.66

v5.15.67

v5.15.68

v5.15.69

v5.15.7

v5.15.70

v5.15.71

v5.15.72

v5.15.73

v5.15.74

v5.15.75

v5.15.76

v5.15.77

v5.15.78

v5.15.79

v5.15.8

v5.15.80

v5.15.81

v5.15.82

v5.15.83

v5.15.84

v5.15.85

v5.15.86

v5.15.87

v5.15.88

v5.15.89

v5.15.9

v5.15.90

v5.15.91

v5.15.92

v5.15.93

v5.15.94

v5.15.95

v5.15.96

v5.15.97

v5.15.98

v5.15.99

v5.16

v5.16-rc1

v5.16-rc2

v5.16-rc3

v5.16-rc4

v5.16-rc5

v5.16-rc6

v5.16-rc7

v5.16-rc8

v5.17

v5.17-rc1

v5.17-rc2

v5.17-rc3

v5.17-rc4

v5.17-rc5

v5.17-rc6

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v5.6

v5.6-rc6

v5.6-rc7

v5.7

v5.7-rc1

v5.7-rc2

v5.7-rc3

v5.7-rc4

v5.7-rc5

v5.7-rc6

v5.7-rc7

v5.8

v5.8-rc1

v5.8-rc2

v5.8-rc3

v5.8-rc4

v5.8-rc5

v5.8-rc6

v5.8-rc7

v5.9

v5.9-rc1

v5.9-rc2

v5.9-rc3

v5.9-rc4

v5.9-rc5

v5.9-rc6

v5.9-rc7

v5.9-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.1.1

v6.1.10

v6.1.11

v6.1.12

v6.1.13

v6.1.14

v6.1.15

v6.1.16

v6.1.17

v6.1.18

v6.1.19

v6.1.2

v6.1.20

v6.1.21

v6.1.22

v6.1.23

v6.1.24

v6.1.25

v6.1.26

v6.1.27

v6.1.28

v6.1.29

v6.1.3

v6.1.30

v6.1.31

v6.1.32

v6.1.33

v6.1.34

v6.1.35

v6.1.36

v6.1.37

v6.1.38

v6.1.39

v6.1.4

v6.1.40

v6.1.41

v6.1.42

v6.1.43

v6.1.44

v6.1.45

v6.1.46

v6.1.47

v6.1.48

v6.1.49

v6.1.5

v6.1.50

v6.1.51

v6.1.52

v6.1.6

v6.1.7

v6.1.8

v6.1.9

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.4

v6.4-rc1

v6.4-rc2

v6.4-rc3

v6.4-rc4

v6.4-rc5

v6.4-rc6

v6.4-rc7

v6.4.1

v6.4.10

v6.4.11

v6.4.12

v6.4.13

v6.4.14

v6.4.15

v6.4.2

v6.4.3

v6.4.4

v6.4.5

v6.4.6

v6.4.7

v6.4.8

v6.4.9

v6.5

v6.5-rc1

v6.5-rc2

v6.5-rc3

v6.5-rc4

v6.5-rc5

v6.5-rc6

v6.5-rc7

v6.5.1

v6.5.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53585.json"

vanir_signatures

[
    {
        "id": "CVE-2023-53585-0a5b9c3e",
        "target": {
            "function": "BPF_CALL_3",
            "file": "net/core/filter.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67312adc96b5a585970d03b62412847afe2c6b01",
        "digest": {
            "function_hash": "337389194893388626895299650417757313332",
            "length": 541.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53585-31adb585",
        "target": {
            "file": "net/core/filter.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@791a12102e5191dcb6ce0b3a99d71b5a2802d12a",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "79354962422427016246252354043139641247",
                "219299604263347496053978971757721847787",
                "64013543073505417623104265435606620045",
                "316351947271244352888373922836301827769"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53585-3510dce7",
        "target": {
            "file": "net/core/filter.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d4522f59fb748a54446846522941a4f09da63e9",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "79354962422427016246252354043139641247",
                "219299604263347496053978971757721847787",
                "64013543073505417623104265435606620045",
                "316351947271244352888373922836301827769"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53585-3dca4d73",
        "target": {
            "file": "net/core/filter.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0ce0fb76610d5fad31f56f2ca8241a2a6717a1b",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "79354962422427016246252354043139641247",
                "219299604263347496053978971757721847787",
                "64013543073505417623104265435606620045",
                "316351947271244352888373922836301827769"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53585-3facaa59",
        "target": {
            "function": "BPF_CALL_3",
            "file": "net/core/filter.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7dcbc0bb0e5cc1823923744befce59ac353135e6",
        "digest": {
            "function_hash": "337389194893388626895299650417757313332",
            "length": 541.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53585-6ed1010b",
        "target": {
            "function": "BPF_CALL_3",
            "file": "net/core/filter.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8aa43cfbb68b25119d2ced14ec717173e2901fa2",
        "digest": {
            "function_hash": "337389194893388626895299650417757313332",
            "length": 541.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53585-7a52949b",
        "target": {
            "file": "net/core/filter.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7dcbc0bb0e5cc1823923744befce59ac353135e6",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "79354962422427016246252354043139641247",
                "219299604263347496053978971757721847787",
                "64013543073505417623104265435606620045",
                "316351947271244352888373922836301827769"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53585-8e9e5212",
        "target": {
            "function": "BPF_CALL_3",
            "file": "net/core/filter.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0ce0fb76610d5fad31f56f2ca8241a2a6717a1b",
        "digest": {
            "function_hash": "337389194893388626895299650417757313332",
            "length": 541.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53585-c0e10150",
        "target": {
            "file": "net/core/filter.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@67312adc96b5a585970d03b62412847afe2c6b01",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "79354962422427016246252354043139641247",
                "219299604263347496053978971757721847787",
                "64013543073505417623104265435606620045",
                "316351947271244352888373922836301827769"
            ]
        },
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53585-c40a284f",
        "target": {
            "function": "BPF_CALL_3",
            "file": "net/core/filter.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d4522f59fb748a54446846522941a4f09da63e9",
        "digest": {
            "function_hash": "337389194893388626895299650417757313332",
            "length": 541.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53585-cb86ae2f",
        "target": {
            "function": "BPF_CALL_3",
            "file": "net/core/filter.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@791a12102e5191dcb6ce0b3a99d71b5a2802d12a",
        "digest": {
            "function_hash": "337389194893388626895299650417757313332",
            "length": 541.0
        },
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53585-dbc00229",
        "target": {
            "file": "net/core/filter.c"
        },
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8aa43cfbb68b25119d2ced14ec717173e2901fa2",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "79354962422427016246252354043139641247",
                "219299604263347496053978971757721847787",
                "64013543073505417623104265435606620045",
                "316351947271244352888373922836301827769"
            ]
        },
        "signature_type": "Line"
    }
]

Git / github.com/gregkh/linux