CVE-2023-53752

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: deal with integer overflows in kmalloc_reserve()

Blamed commit changed:

ptr = kmalloc(size);

if (ptr)

size = ksize(ptr);

size = kmalloc_size_roundup(size);

ptr = kmalloc(size);

This allowed various crash as reported by syzbot [1]

and Kyle Zeng.

Problem is that if @size is bigger than 0x80000001,

kmalloc_size_roundup(size) returns 2^32.

kmalloc_reserve() uses a 32bit variable (obj_size),

so 2^32 is truncated to 0.

kmalloc(0) returns ZERO_SIZE_PTR which is not handled by

skb allocations.

Following trace can be triggered if a netdev->mtu is set

close to 0x7fffffff

We might in the future limit netdev->mtu to more sensible

limit (like KMALLOC_MAX_SIZE).

This patch is based on a syzbot report, and also a report

and tentative fix from Kyle Zeng.

[1]

BUG: KASAN: user-memory-access in __build_skb_around net/core/skbuff.c:294 [inline]

BUG: KASAN: user-memory-access in __alloc_skb+0x3c4/0x6e8

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References