CVE-2023-53517

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tipc: do not update mtu if msg_max is too small in mtu negotiation

When doing link mtu negotiation, a malicious peer may send Activate msg

with a very small mtu, e.g. 4 in Shuang's testing, without checking for

the minimum mtu, l->mtu will be set to 4 in tipc_link_proto_rcv(), then

n->links[bearer_id].mtu is set to 4294967228, which is a overflow of

'4 - INT_H_SIZE - EMSG_OVERHEAD' in tipc_link_mss().

With tipc_link.mtu = 4, tipc_link_xmit() kept printing the warning:

tipc: Too large msg, purging xmit list 1 5 0 40 4!

tipc: Too large msg, purging xmit list 1 15 0 60 4!

And with tipc_link_entry.mtu 4294967228, a huge skb was allocated in

named_distribute(), and when purging it in tipc_link_xmit(), a crash

was even caused:

general protection fault, probably for non-canonical address 0x2100001011000dd: 0000 [#1] PREEMPT SMP PTI

CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 6.3.0.neta #19

RIP: 0010:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References