CVE-2023-53489

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.

syzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY

skbs. We can reproduce the problem with these sequences:

sk = socket(AF_INET, SOCK_DGRAM, 0)

sk.setsockopt(SOL_SOCKET, SO_TIMESTAMPING, SOF_TIMESTAMPING_TX_SOFTWARE)

sk.setsockopt(SOL_SOCKET, SO_ZEROCOPY, 1)

sk.sendto(b'', MSG_ZEROCOPY, ('127.0.0.1', 53))

sk.close()

sendmsg() calls msg_zerocopy_alloc(), which allocates a skb, sets

skb->cb->ubuf.refcnt to 1, and calls sock_hold(). Here, struct

ubuf_info_msgzc indirectly holds a refcnt of the socket. When the

skb is sent, __skb_tstamp_tx() clones it and puts the clone into

the socket's error queue with the TX timestamp.

When the original skb is received locally, skb_copy_ubufs() calls

skb_unclone(), and pskb_expand_head() increments skb->cb->ubuf.refcnt.

This additional count is decremented while freeing the skb, but struct

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References