CVE-2023-52889

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

apparmor: Fix null pointer deref when receiving skb during sock creation

The panic below is observed when receiving ICMP packets with secmark set

while an ICMP raw socket is being created. SK_CTX(sk)->label is updated

in apparmor_socket_post_create(), but the packet is delivered to the

socket before that, causing the null pointer dereference.

Drop the packet if label context is not set.

BUG: kernel NULL pointer dereference, address: 000000000000004c

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD 0 P4D 0

Oops: 0000 [#1] PREEMPT SMP NOPTI

CPU: 0 PID: 407 Comm: a.out Not tainted 6.4.12-arch1-1 #1 3e6fa2753a2d75925c34ecb78e22e85a65d083df

Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/28/2020

RIP: 0010:aa_label_next_confined+0xb/0x40

Code: 00 00 48 89 ef e8 d5 25 0c 00 e9 66 ff ff ff 90 90 90

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References