CVE-2023-53445

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: qrtr: Fix a refcount bug in qrtr_recvmsg()

Syzbot reported a bug as following:

refcount_t: addition on 0; use-after-free.

...

RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25

...

Call Trace:

<TASK>

__refcount_add include/linux/refcount.h:199 [inline]

__refcount_inc include/linux/refcount.h:250 [inline]

refcount_inc include/linux/refcount.h:267 [inline]

kref_get include/linux/kref.h:45 [inline]

qrtr_node_acquire net/qrtr/af_qrtr.c:202 [inline]

qrtr_node_lookup net/qrtr/af_qrtr.c:398 [inline]

qrtr_send_resume_tx net/qrtr/af_qrtr.c:1003 [inline]

qrtr_recvmsg+0x85f/0x990 net/qrtr/af_qrtr.c:1070

sock_recvmsg_nosec net/socket.c:1017 [inline]

sock_recvmsg+0xe2/0x160 net/socket.c:1038

qrtr_ns_worker+0x170/0x1700 net/qrtr/ns.c:688

process_one_work+0x991/0x15c0 kernel/workqueue.c:2390

worker_thread+0x669/0x1090 kernel/workqueue.c:2537

It occurs in the concurrent scenario of qrtr_recvmsg() and

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References