CVE-2023-53338: lwt: Fix return values of BPF xmit ops
In the Linux kernel, the following vulnerability has been resolved:
lwt: Fix return values of BPF xmit ops
BPF encap ops can return different types of positive values, such like NETRXDROP, NETXMITCN, NETDEVTXBUSY, and so on, from function skbdoredirect and bpflwtxmitreroute. At the xmit hook, such return values would be treated implicitly as LWTUNNELXMITCONTINUE in ip(6)finishoutput2. When this happens, skbs that have been freed would continue to the neighbor subsystem, causing use-after-free bug and kernel crashes.
To fix the incorrect behavior, skbdoredirect return values can be simply discarded, the same as tc-egress behavior. On the other hand, bpflwtxmitreroute returns useful errors to local senders, e.g. PMTU information. Thus convert its return values to avoid the conflict with LWTUNNELXMITCONTINUE.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53338?
CVE-2023-53338 is classified as a vulnerability in the Linux kernel that affects the handling of BPF encap operations.
How do I fix CVE-2023-53338?
To fix CVE-2023-53338, update your Linux kernel to the latest stable version where the vulnerability has been resolved.
What systems are affected by CVE-2023-53338?
CVE-2023-53338 affects all versions of the Linux kernel that are using BPF encap operations.
What types of values can BPF xmit ops return in CVE-2023-53338?
BPF xmit ops can return values such as NET_RX_DROP, NET_XMIT_CN, and NETDEV_TX_BUSY as part of the vulnerability.
Is CVE-2023-53338 a remote exploitation vulnerability?
No, CVE-2023-53338 primarily involves local operations and does not facilitate remote exploitation.