CVE-2023-52986

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener

A listening socket linked to a sockmap has its sk_prot overridden. It

points to one of the struct proto variants in tcp_bpf_prots. The variant

depends on the socket's family and which sockmap programs are attached.

A child socket cloned from a TCP listener initially inherits their sk_prot.

But before cloning is finished, we restore the child's proto to the

listener's original non-tcp_bpf_prots one. This happens in

tcp_create_openreq_child -> tcp_bpf_clone.

Today, in tcp_bpf_clone we detect if the child's proto should be restored

by checking only for the TCP_BPF_BASE proto variant. This is not

correct. The sk_prot of listening socket linked to a sockmap can point to

to any variant in tcp_bpf_prots.

If the listeners sk_prot happens to be not the TCP_BPF_BASE variant, then

the child socket unintentionally is left if the inherited sk_prot by

tcp_bpf_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References