CVE-2023-53053

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

erspan: do not use skb_mac_header() in ndo_start_xmit()

Drivers should not assume skb_mac_header(skb) == skb->data in their

ndo_start_xmit().

Use skb_network_offset() and skb_transport_offset() which

better describe what is needed in erspan_fb_xmit() and

ip6erspan_tunnel_xmit()

syzbot reported:

WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 skb_mac_header include/linux/skbuff.h:2873 [inline]

WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962

Modules linked in:

CPU: 0 PID: 5083 Comm: syz-executor406 Not tainted 6.3.0-rc2-syzkaller-00866-gd4671cb96fa3 #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023

RIP: 0010:skb_mac_header include/linux/skbuff.h:2873 [inline]

RIP: 0010:ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962

Code: 04 02 41 01 de 84 c0 74 08 3c 03 0f 8e 1c 0a 00 00 45 89 b4 24 c8 0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References