CVE-2023-53192

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: Fix nexthop hash size

The nexthop code expects a 31 bit hash, such as what is returned by

fib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash

returned by skb_get_hash() can lead to problems related to the fact that

'int hash' is a negative number when the MSB is set.

In the case of hash threshold nexthop groups, nexthop_select_path_hthr()

will disproportionately select the first nexthop group entry. In the case

of resilient nexthop groups, nexthop_select_path_res() may do an out of

bounds access in nh_buckets[], for example:

hash = -912054133

num_nh_buckets = 2

bucket_index = 65535

which leads to the following panic:

BUG: unable to handle page fault for address: ffffc900025910c8

PGD 100000067 P4D 100000067 PUD 10026b067 PMD 0

Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI

CPU: 4 PID: 856 Comm: kworker/4:3 Not tainted 6.5.0-rc2+ #34

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References