CVE-2023-52796

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipvlan: add ipvlan_route_v6_outbound() helper

Inspired by syzbot reports using a stack of multiple ipvlan devices.

Reduce stack size needed in ipvlan_process_v6_outbound() by moving

the flowi6 struct used for the route lookup in an non inlined

helper. ipvlan_route_v6_outbound() needs 120 bytes on the stack,

immediately reclaimed.

Also make sure ipvlan_process_v4_outbound() is not inlined.

We might also have to lower MAX_NEST_DEV, because only syzbot uses

setups with more than four stacked devices.

BUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000)

stack guard page: 0000 [#1] SMP KASAN

CPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023

RIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188

Code: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References