CVE-2023-53669: tcp: fix skb_copy_ubufs() vs BIG TCP
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix skbcopyubufs() vs BIG TCP
David Ahern reported crashes in skbcopyubufs() caused by TCP tx zerocopy using hugepages, and skb length bigger than ~68 KB.
skbcopyubufs() assumed it could copy all payload using up to MAXSKBFRAGS order-0 pages.
This assumption broke when BIG TCP was able to put up to 512 KB per skb.
We did not hit this bug at Google because we use CONFIGMAXSKBFRAGS=45 and limit gsomaxsize to 180000.
A solution is to use higher order pages if needed.
v2: add missing GFPCOMP, or we leak memory.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53669?
CVE-2023-53669 is considered to have a high severity due to the potential to cause crashes in the Linux kernel.
How do I fix CVE-2023-53669?
To fix CVE-2023-53669, update your Linux kernel to the latest version available that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2023-53669?
CVE-2023-53669 affects versions of the Linux kernel that utilize TCP tx zerocopy with hugepages and certain skb length limitations.
What kind of attacks can CVE-2023-53669 enable?
CVE-2023-53669 can potentially enable DoS attacks through kernel crashes stemming from the affected skb_copy_ubufs() function.
Who reported CVE-2023-53669?
CVE-2023-53669 was reported by David Ahern, highlighting issues with TCP transmission and hugepages.