CVE-2023-53198

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

raw: Fix NULL deref in raw_get_next().

Dae R. Jeong reported a NULL deref in raw_get_next() [0].

It seems that the repro was running these sequences in parallel so

that one thread was iterating on a socket that was being freed in

another netns.

unshare(0x40060200)

r0 = syz_open_procfs(0x0, &(0x7f0000002080)='net/raw\x00')

socket$inet_icmp_raw(0x2, 0x3, 0x1)

pread64(r0, &(0x7f0000000000)=""/10, 0xa, 0x10000000007f)

After commit 0daf07e52709 ("raw: convert raw sockets to RCU"), we

use RCU and hlist_nulls_for_each_entry() to iterate over SOCK_RAW

sockets. However, we should use spinlock for slow paths to avoid

the NULL deref.

Also, SOCK_RAW does not use SLAB_TYPESAFE_BY_RCU, and the slab object

is not reused during iteration in the grace period. In fact, the

lockless readers do not check the nulls marker with get_nulls_value().

So, SOCK_RAW should use hlist instead of hlist_nulls.

Instead of adding an unn

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References