CVE-2023-53836

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix skb refcnt race after locking changes

There is a race where skb's from the sk_psock_backlog can be referenced

after userspace side has already skb_consumed() the sk_buff and its refcnt

dropped to zer0 causing use after free.

The flow is the following:

while ((skb = skb_peek(&psock->ingress_skb))

sk_psock_handle_Skb(psock, skb, ..., ingress)

if (!ingress) ...

sk_psock_skb_ingress

sk_psock_skb_ingress_enqueue(skb)

msg->skb = skb

sk_psock_queue_msg(psock, msg)

skb_dequeue(&psock->ingress_skb)

The sk_psock_queue_msg() puts the msg on the ingress_msg queue. This is

what the application reads when recvmsg() is called. An application can

read this anytime after the msg is placed on the queue. The recvmsg hook

will also read msg->skb and then after user space reads the msg will call

consume_skb(skb) on it effectively free'ing it.

But, the race is in above whe

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References