CVE-2023-52701

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: use a bounce buffer for copying skb->mark

syzbot found arm64 builds would crash in sock_recv_mark()

when CONFIG_HARDENED_USERCOPY=y

x86 and powerpc are not detecting the issue because

they define user_access_begin.

This will be handled in a different patch,

because a check_object_size() is missing.

Only data from skb->cb[] can be copied directly to/from user space,

as explained in commit 79a8a642bf05 ("net: Whitelist

the skbuff_head_cache "cb" field")

syzbot report was:

usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_head_cache' (offset 168, size 4)!

------------[ cut here ]------------

kernel BUG at mm/usercopy.c:102 !

Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP

Modules linked in:

CPU: 0 PID: 4410 Comm: syz-executor533 Not tainted 6.2.0-rc7-syzkaller-17907-g2d3827b3f393 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023

ps

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References