CVE-2023-52577
Linux Kernel DCCP socket Buffer Overflow Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: dccp: fix dccp_v4_err()/dccp_v6_err() again dh->dccph_x is the 9th byte (offset 8) in "struct dccp_hdr", not in the "byte 7" as Jann claimed. We need to make sure the ICMP messages are big enough, using more standard ways (no more assumptions). syzbot reported: BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2681 [inline] BUG: KMSAN: uninit-value in dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 icmpv6_notify+0x4c7/0x880 net/ipv6/icmp.c:867 icmpv6_rcv+0x19d5/0x30d0 ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:304 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 dst_input include/net/dst.h:468 [inline] ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:304 [inline] ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5523 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637 netif_receive_skb_internal net/core/dev.c:5723 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5782 tun_rx_batched+0x83b/0x920 tun_get_user+0x564c/0x6940 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6313 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2795 tun_alloc_skb drivers/net/tun.c:1531 [inline] tun_get_user+0x23cf/0x6940 drivers/net/tun.c:1846 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 4995 Comm: syz-executor153 Not tainted 6.6.0-rc1-syzkaller-00014-ga747acc0b752 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
INFO
Published Date :
March 2, 2024, 10:15 p.m.
Last Modified :
Dec. 11, 2024, 4:21 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the Linux kernel to the latest available version.
- Reboot the system after kernel upgrade.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2023-52577.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2023-52577 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2023-52577
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2023-52577 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2023-52577 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Dec. 11, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NIST CWE-908 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:4.14.326:*:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:4.19.295:*:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.4.257:*:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.195 up to (excluding) 5.10.198 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.132 up to (excluding) 5.15.134 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.53 up to (excluding) 6.1.56 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.5.3 up to (excluding) 6.5.6 Changed Reference Type https://git.kernel.org/stable/c/1512d8f45d3c5d0b5baa00bd8e600492fa569f40 No Types Assigned https://git.kernel.org/stable/c/1512d8f45d3c5d0b5baa00bd8e600492fa569f40 Patch Changed Reference Type https://git.kernel.org/stable/c/1512d8f45d3c5d0b5baa00bd8e600492fa569f40 No Types Assigned https://git.kernel.org/stable/c/1512d8f45d3c5d0b5baa00bd8e600492fa569f40 Patch Changed Reference Type https://git.kernel.org/stable/c/26df9ab5de308caa1503d937533c56c35793018d No Types Assigned https://git.kernel.org/stable/c/26df9ab5de308caa1503d937533c56c35793018d Patch Changed Reference Type https://git.kernel.org/stable/c/26df9ab5de308caa1503d937533c56c35793018d No Types Assigned https://git.kernel.org/stable/c/26df9ab5de308caa1503d937533c56c35793018d Patch Changed Reference Type https://git.kernel.org/stable/c/4600beae416d754a3cedbb1ecea8181ec05073b6 No Types Assigned https://git.kernel.org/stable/c/4600beae416d754a3cedbb1ecea8181ec05073b6 Patch Changed Reference Type https://git.kernel.org/stable/c/4600beae416d754a3cedbb1ecea8181ec05073b6 No Types Assigned https://git.kernel.org/stable/c/4600beae416d754a3cedbb1ecea8181ec05073b6 Patch Changed Reference Type https://git.kernel.org/stable/c/60d73c62e3e4464f375758b6f2459c13d46465b6 No Types Assigned https://git.kernel.org/stable/c/60d73c62e3e4464f375758b6f2459c13d46465b6 Patch Changed Reference Type https://git.kernel.org/stable/c/60d73c62e3e4464f375758b6f2459c13d46465b6 No Types Assigned https://git.kernel.org/stable/c/60d73c62e3e4464f375758b6f2459c13d46465b6 Patch Changed Reference Type https://git.kernel.org/stable/c/62c218124fe58372e0e1f60d5b634d21c264b337 No Types Assigned https://git.kernel.org/stable/c/62c218124fe58372e0e1f60d5b634d21c264b337 Patch Changed Reference Type https://git.kernel.org/stable/c/62c218124fe58372e0e1f60d5b634d21c264b337 No Types Assigned https://git.kernel.org/stable/c/62c218124fe58372e0e1f60d5b634d21c264b337 Patch Changed Reference Type https://git.kernel.org/stable/c/6af289746a636f71f4c0535a9801774118486c7a No Types Assigned https://git.kernel.org/stable/c/6af289746a636f71f4c0535a9801774118486c7a Patch Changed Reference Type https://git.kernel.org/stable/c/6af289746a636f71f4c0535a9801774118486c7a No Types Assigned https://git.kernel.org/stable/c/6af289746a636f71f4c0535a9801774118486c7a Patch Changed Reference Type https://git.kernel.org/stable/c/73be49248a04746096339a48a33fa2f03bd85969 No Types Assigned https://git.kernel.org/stable/c/73be49248a04746096339a48a33fa2f03bd85969 Patch Changed Reference Type https://git.kernel.org/stable/c/73be49248a04746096339a48a33fa2f03bd85969 No Types Assigned https://git.kernel.org/stable/c/73be49248a04746096339a48a33fa2f03bd85969 Patch Changed Reference Type https://git.kernel.org/stable/c/a6f4d582e25d512c9b492670b6608436694357b3 No Types Assigned https://git.kernel.org/stable/c/a6f4d582e25d512c9b492670b6608436694357b3 Patch Changed Reference Type https://git.kernel.org/stable/c/a6f4d582e25d512c9b492670b6608436694357b3 No Types Assigned https://git.kernel.org/stable/c/a6f4d582e25d512c9b492670b6608436694357b3 Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/1512d8f45d3c5d0b5baa00bd8e600492fa569f40 Added Reference https://git.kernel.org/stable/c/26df9ab5de308caa1503d937533c56c35793018d Added Reference https://git.kernel.org/stable/c/4600beae416d754a3cedbb1ecea8181ec05073b6 Added Reference https://git.kernel.org/stable/c/60d73c62e3e4464f375758b6f2459c13d46465b6 Added Reference https://git.kernel.org/stable/c/62c218124fe58372e0e1f60d5b634d21c264b337 Added Reference https://git.kernel.org/stable/c/6af289746a636f71f4c0535a9801774118486c7a Added Reference https://git.kernel.org/stable/c/73be49248a04746096339a48a33fa2f03bd85969 Added Reference https://git.kernel.org/stable/c/a6f4d582e25d512c9b492670b6608436694357b3 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 28, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 04, 2024
Action Type Old Value New Value Added Reference kernel.org https://git.kernel.org/stable/c/6af289746a636f71f4c0535a9801774118486c7a [No types assigned] -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Mar. 02, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: dccp: fix dccp_v4_err()/dccp_v6_err() again dh->dccph_x is the 9th byte (offset 8) in "struct dccp_hdr", not in the "byte 7" as Jann claimed. We need to make sure the ICMP messages are big enough, using more standard ways (no more assumptions). syzbot reported: BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2681 [inline] BUG: KMSAN: uninit-value in dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 pskb_may_pull_reason include/linux/skbuff.h:2667 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] dccp_v6_err+0x426/0x1aa0 net/dccp/ipv6.c:94 icmpv6_notify+0x4c7/0x880 net/ipv6/icmp.c:867 icmpv6_rcv+0x19d5/0x30d0 ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438 ip6_input_finish net/ipv6/ip6_input.c:483 [inline] NF_HOOK include/linux/netfilter.h:304 [inline] ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492 ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586 dst_input include/net/dst.h:468 [inline] ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:304 [inline] ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5523 [inline] __netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5637 netif_receive_skb_internal net/core/dev.c:5723 [inline] netif_receive_skb+0x58/0x660 net/core/dev.c:5782 tun_rx_batched+0x83b/0x920 tun_get_user+0x564c/0x6940 drivers/net/tun.c:2002 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:650 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6313 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2795 tun_alloc_skb drivers/net/tun.c:1531 [inline] tun_get_user+0x23cf/0x6940 drivers/net/tun.c:1846 tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048 call_write_iter include/linux/fs.h:1985 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x8ef/0x15c0 fs/read_write.c:584 ksys_write+0x20f/0x4c0 fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __x64_sys_write+0x93/0xd0 fs/read_write.c:646 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 4995 Comm: syz-executor153 Not tainted 6.6.0-rc1-syzkaller-00014-ga747acc0b752 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023 Added Reference Linux https://git.kernel.org/stable/c/4600beae416d754a3cedbb1ecea8181ec05073b6 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/62c218124fe58372e0e1f60d5b634d21c264b337 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/a6f4d582e25d512c9b492670b6608436694357b3 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/60d73c62e3e4464f375758b6f2459c13d46465b6 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/26df9ab5de308caa1503d937533c56c35793018d [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/73be49248a04746096339a48a33fa2f03bd85969 [No types assigned] Added Reference Linux https://git.kernel.org/stable/c/1512d8f45d3c5d0b5baa00bd8e600492fa569f40 [No types assigned]