CVE-2023-52580

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/core: Fix ETH_P_1588 flow dissector

When a PTP ethernet raw frame with a size of more than 256 bytes followed

by a 0xff pattern is sent to __skb_flow_dissect, nhoff value calculation

is wrong. For example: hdr->message_length takes the wrong value (0xffff)

and it does not replicate real header length. In this case, 'nhoff' value

was overridden and the PTP header was badly dissected. This leads to a

kernel crash.

net/core: flow_dissector

net/core flow dissector nhoff = 0x0000000e

net/core flow dissector hdr->message_length = 0x0000ffff

net/core flow dissector nhoff = 0x0001000d (u16 overflow)

...

skb linear: 00000000: 00 a0 c9 00 00 00 00 a0 c9 00 00 00 88

skb frag: 00000000: f7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff

Using the size of the ptp_header struct will allow the corrected

calculation of the nhoff value.

net/core flow dissector nhoff = 0x0000000e

net/core flow dissector nhoff = 0x00000030 (s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References