CVE-2023-53240

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xsk: check IFF_UP earlier in Tx path

Xsk Tx can be triggered via either sendmsg() or poll() syscalls. These

two paths share a call to common function xsk_xmit() which has two

sanity checks within. A pseudo code example to show the two paths:

__xsk_sendmsg() : xsk_poll():

if (unlikely(!xsk_is_bound(xs))) if (unlikely(!xsk_is_bound(xs)))

return -ENXIO; return mask;

if (unlikely(need_wait)) (...)

return -EOPNOTSUPP; xsk_xmit()

mark napi id

(...)

xsk_xmit()

xsk_xmit():

if (unlikely(!(xs->dev->flags & IFF_UP)))

return -ENETDOWN;

if (unlikely(!xs->tx))

return -ENOBUFS;

As it can be observed above, in sendmsg() napi id can be marked on

interface that was not brought up and this causes a NULL ptr

dereference:

[31757.505631] BUG: kernel NULL pointer dereference, address: 0000000000000018

[31757.512710] #PF: supervisor read acces

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References