CVE-2023-53103

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails

syzbot reported a warning[1] where the bond device itself is a slave and

we try to enslave a non-ethernet device as the first slave which fails

but then in the error path when ether_setup() restores the bond device

it also clears all flags. In my previous fix[2] I restored the

IFF_MASTER flag, but I didn't consider the case that the bond device

itself might also be a slave with IFF_SLAVE set, so we need to restore

that flag as well. Use the bond_ether_setup helper which does the right

thing and restores the bond's flags properly.

Steps to reproduce using a nlmon dev:

$ ip l add nlmon0 type nlmon

$ ip l add bond1 type bond

$ ip l add bond2 type bond

$ ip l set bond1 master bond2

$ ip l set dev nlmon0 master bond1

$ ip -d l sh dev bond1

22: bond1: <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noqueue master bond2 state DOWN mode DEFAULT group d

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References