CVE-2023-53186

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

skbuff: Fix a race between coalescing and releasing SKBs

Commit 1effe8ca4e34 ("skbuff: fix coalescing for page_pool fragment

recycling") allowed coalescing to proceed with non page pool page and page

pool page when @from is cloned, i.e.

to->pp_recycle --> false

from->pp_recycle --> true

skb_cloned(from) --> true

However, it actually requires skb_cloned(@from) to hold true until

coalescing finishes in this situation. If the other cloned SKB is

released while the merging is in process, from_shinfo->nr_frags will be

set to 0 toward the end of the function, causing the increment of frag

page _refcount to be unexpectedly skipped resulting in inconsistent

reference counts. Later when SKB(@to) is released, it frees the page

directly even though the page pool page is still in use, leading to

use-after-free or double-free errors. So it should be prohibited.

The double-free error message below prompted us to investigat

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References