CVE-2023-52991

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: fix NULL pointer in skb_segment_list

Commit 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.")

introduced UDP listifyed GRO. The segmentation relies on frag_list being

untouched when passing through the network stack. This assumption can be

broken sometimes, where frag_list itself gets pulled into linear area,

leaving frag_list being NULL. When this happens it can trigger

following NULL pointer dereference, and panic the kernel. Reverse the

test condition should fix it.

[19185.577801][ C1] BUG: kernel NULL pointer dereference, address:

...

[19185.663775][ C1] RIP: 0010:skb_segment_list+0x1cc/0x390

...

[19185.834644][ C1] Call Trace:

[19185.841730][ C1] <TASK>

[19185.848563][ C1] __udp_gso_segment+0x33e/0x510

[19185.857370][ C1] inet_gso_segment+0x15b/0x3e0

[19185.866059][ C1] skb_mac_gso_segment+0x97/0x110

[19185.874939][ C1] __skb_gso_segment+0xb2/0x160

[19185.883646][ C1]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References