CVE-2023-54004

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().

syzbot reported [0] a null-ptr-deref in sk_get_rmem0() while using

IPPROTO_UDPLITE (0x88):

14:25:52 executing program 1:

r0 = socket$inet6(0xa, 0x80002, 0x88)

We had a similar report [1] for probably sk_memory_allocated_add()

in __sk_mem_raise_allocated(), and commit c915fe13cbaa ("udplite: fix

NULL pointer dereference") fixed it by setting .memory_allocated for

udplite_prot and udplitev6_prot.

To fix the variant, we need to set either .sysctl_wmem_offset or

.sysctl_rmem.

Now UDP and UDPLITE share the same value for .memory_allocated, so we

use the same .sysctl_wmem_offset for UDP and UDPLITE.

[0]:

general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN

KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]

CPU: 0 PID: 6829 Comm: syz-executor.1 Not tainted 6.4.0-rc2-syzkal

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References