CVE-2023-53021

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_taprio: fix possible use-after-free

syzbot reported a nasty crash [1] in net_tx_action() which

made little sense until we got a repro.

This repro installs a taprio qdisc, but providing an

invalid TCA_RATE attribute.

qdisc_create() has to destroy the just initialized

taprio qdisc, and taprio_destroy() is called.

However, the hrtimer used by taprio had already fired,

therefore advance_sched() called __netif_schedule().

Then net_tx_action was trying to use a destroyed qdisc.

We can not undo the __netif_schedule(), so we must wait

until one cpu serviced the qdisc before we can proceed.

Many thanks to Alexander Potapenko for his help.

[1]

BUG: KMSAN: uninit-value in queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline]

BUG: KMSAN: uninit-value in do_raw_spin_trylock include/linux/spinlock.h:191 [inline]

BUG: KMSAN: uninit-value in __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inli

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References