CVE-2023-53433

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: add vlan_get_protocol_and_depth() helper

Before blamed commit, pskb_may_pull() was used instead

of skb_header_pointer() in __vlan_get_protocol() and friends.

Few callers depended on skb->head being populated with MAC header,

syzbot caught one of them (skb_mac_gso_segment())

Add vlan_get_protocol_and_depth() to make the intent clearer

and use it where sensible.

This is a more generic fix than commit e9d3f80935b6

("net/af_packet: make sure to pull mac header") which was

dealing with a similar issue.

kernel BUG at include/linux/skbuff.h:2655 !

invalid opcode: 0000 [#1] SMP KASAN

CPU: 0 PID: 1441 Comm: syz-executor199 Not tainted 6.1.24-syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023

RIP: 0010:__skb_pull include/linux/skbuff.h:2655 [inline]

RIP: 0010:skb_mac_gso_segment+0x68f/0x6a0 net/core/gro.c:136

Code: fd 48 8b 5c 24 10 44 89 6b 70 48 c7 c7 c0 ae 0d 86 4

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References