CVE-2023-53107

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

veth: Fix use after free in XDP_REDIRECT

Commit 718a18a0c8a6 ("veth: Rework veth_xdp_rcv_skb in order

to accept non-linear skb") introduced a bug where it tried to

use pskb_expand_head() if the headroom was less than

XDP_PACKET_HEADROOM. This however uses kmalloc to expand the head,

which will later allow consume_skb() to free the skb while is it still

in use by AF_XDP.

Previously if the headroom was less than XDP_PACKET_HEADROOM we

continued on to allocate a new skb from pages so this restores that

behavior.

BUG: KASAN: use-after-free in __xsk_rcv+0x18d/0x2c0

Read of size 78 at addr ffff888976250154 by task napi/iconduit-g/148640

CPU: 5 PID: 148640 Comm: napi/iconduit-g Kdump: loaded Tainted: G O 6.1.4-cloudflare-kasan-2023.1.2 #1

Hardware name: Quanta Computer Inc. QuantaPlex T41S-2U/S2S-MB, BIOS S2S_3B10.03 06/21/2018

Call Trace:

<TASK>

dump_stack_lvl+0x34/0x48

print_report+0x170/0x473

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References