CVE-2023-53559
In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix potential slab-use-after-free in decode_session6 When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix potential slab-use-after-free in decode_session6 When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ip_vti device sends IPv6 packets. As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.15% probability · 4th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-416
- Affected
- linux/linux kernel
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
References
- https://git.kernel.org/stable/c/0b4d69539fdea138af2befe08893850c89248068Patch
- https://git.kernel.org/stable/c/2b05bf5dc437f7891dd409a3eaf5058459391c7aPatch
- https://git.kernel.org/stable/c/6018a266279b1a75143c7c0804dd08a5fc4c3e0bPatch
- https://git.kernel.org/stable/c/78e397a43e1c47321a4679cc49a6c4530bf820b9Patch
- https://git.kernel.org/stable/c/7dfe23659f3677c08a60a0056cda2d91a79c15caPatch
- https://git.kernel.org/stable/c/82fb41c5de243e7dfa90f32ca58e35adaff56c1dPatch
- https://git.kernel.org/stable/c/d34c30442d5e53a33cde79ca163320dbe2432cbdPatch
- https://git.kernel.org/stable/c/e1e04cc2ef2c0c0866c19f5627149a76c2baae32Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.