CVE-2023-53781

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

smc: Fix use-after-free in tcp_write_timer_handler().

With Eric's ref tracker, syzbot finally found a repro for

use-after-free in tcp_write_timer_handler() by kernel TCP

sockets. [0]

If SMC creates a kernel socket in __smc_create(), the kernel

socket is supposed to be freed in smc_clcsock_release() by

calling sock_release() when we close() the parent SMC socket.

However, at the end of smc_clcsock_release(), the kernel

socket's sk_state might not be TCP_CLOSE. This means that

we have not called inet_csk_destroy_sock() in __tcp_close()

and have not stopped the TCP timers.

The kernel socket's TCP timers can be fired later, so we

need to hold a refcnt for net as we do for MPTCP subflows

in mptcp_subflow_create_socket().

[0]:

leaked reference.

sk_alloc (./include/net/net_namespace.h:335 net/core/sock.c:2108)

inet_create (net/ipv4/af_inet.c:319 net/ipv4/af_inet.c:244)

__sock_create (net/socket.c:1546)

smc_create (

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References