CVE-2023-52523

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets

With a SOCKMAP/SOCKHASH map and an sk_msg program user can steer messages

sent from one TCP socket (s1) to actually egress from another TCP

socket (s2):

tcp_bpf_sendmsg(s1) // = sk_prot->sendmsg

tcp_bpf_send_verdict(s1) // __SK_REDIRECT case

tcp_bpf_sendmsg_redir(s2)

tcp_bpf_push_locked(s2)

tcp_bpf_push(s2)

tcp_rate_check_app_limited(s2) // expects tcp_sock

tcp_sendmsg_locked(s2) // ditto

There is a hard-coded assumption in the call-chain, that the egress

socket (s2) is a TCP socket.

However in commit 122e6c79efe1 ("sock_map: Update sock type checks for

UDP") we have enabled redirects to non-TCP sockets. This was done for the

sake of BPF sk_skb programs. There was no indention to support sk_msg

send-to-egress use case.

As a result, attempts to send-to-egress through a non-TCP socket lead to a

crash due to invalid downcast from so

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References