CVE-2023-53995

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: fix one memleak in __inet_del_ifa()

I got the below warning when do fuzzing test:

unregister_netdevice: waiting for bond0 to become free. Usage count = 2

It can be repoduced via:

ip link add bond0 type bond

sysctl -w net.ipv4.conf.bond0.promote_secondaries=1

ip addr add 4.117.174.103/0 scope 0x40 dev bond0

ip addr add 192.168.100.111/255.255.255.254 scope 0 dev bond0

ip addr add 0.0.0.4/0 scope 0x40 secondary dev bond0

ip addr del 4.117.174.103/0 scope 0x40 dev bond0

ip link delete bond0 type bond

In this reproduction test case, an incorrect 'last_prim' is found in

__inet_del_ifa(), as a result, the secondary address(0.0.0.4/0 scope 0x40)

is lost. The memory of the secondary address is leaked and the reference of

in_device and net_device is leaked.

Fix this problem:

Look for 'last_prim' starting at location of the deleted IP and inserting

the promoted IP into the location of 'last_prim'.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References