CVE-2023-53102

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ice: xsk: disable txq irq before flushing hw

ice_qp_dis() intends to stop a given queue pair that is a target of xsk

pool attach/detach. One of the steps is to disable interrupts on these

queues. It currently is broken in a way that txq irq is turned off

*after* HW flush which in turn takes no effect.

ice_qp_dis():

-> ice_qvec_dis_irq()

--> disable rxq irq

--> flush hw

-> ice_vsi_stop_tx_ring()

-->disable txq irq

Below splat can be triggered by following steps:

- start xdpsock WITHOUT loading xdp prog

- run xdp_rxq_info with XDP_TX action on this interface

- start traffic

- terminate xdpsock

[ 256.312485] BUG: kernel NULL pointer dereference, address: 0000000000000018

[ 256.319560] #PF: supervisor read access in kernel mode

[ 256.324775] #PF: error_code(0x0000) - not-present page

[ 256.329994] PGD 0 P4D 0

[ 256.332574] Oops: 0000 [#1] PREEMPT SMP NOPTI

[ 256.337006] CPU: 3 PID: 32 Comm: ksoftirqd/3 Tainted:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References