CVE-2023-54193

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: remove block_cb from driver_list before freeing

Error handler of tcf_block_bind() frees the whole bo->cb_list on error.

However, by that time the flow_block_cb instances are already in the driver

list because driver ndo_setup_tc() callback is called before that up the

call chain in tcf_block_offload_cmd(). This leaves dangling pointers to

freed objects in the list and causes use-after-free[0]. Fix it by also

removing flow_block_cb instances from driver_list before deallocating them.

[0]:

[ 279.868433] ==================================================================

[ 279.869964] BUG: KASAN: slab-use-after-free in flow_block_cb_setup_simple+0x631/0x7c0

[ 279.871527] Read of size 8 at addr ffff888147e2bf20 by task tc/2963

[ 279.873151] CPU: 6 PID: 2963 Comm: tc Not tainted 6.3.0-rc6+ #4

[ 279.874273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuil

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References