In the Linux kernel, the following vulnerability has been resolved:
l2tp: close all race conditions in l2tptunnelregister()
The code in l2tptunnelregister() is racy in several ways:
It modifies the tunnel socket after publishing it.
It calls setupudptunnel_sock() on an existing socket without locking.
It changes sock lock class on fly, which triggers many syzbot reports.
This patch amends all of them by moving socket initialization code before publishing and under sock lock. As suggested by Jakub, the l2tp lockdep class is not necessary as we can just switch to bhlocksock_nested().
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53020.json"
}[
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"81203019483778037833983222310784909202",
"27707684922399675591787362137326887573",
"274866530259093497296718872401914472797",
"333238411611240721809923810595261393974",
"190055022644985386869665242178818367080",
"282678688651668322439676137233841579999",
"242485930944893274621912860491071088688",
"331817907932597601891986281084107552877",
"38914643839654979979452473000698832918",
"330581827559828850087692769990017556885",
"325558989949580746671305241357338063117",
"129948838027393952700238643756832696265",
"261036051037459340271568631857793937311",
"253684403358398311864024551605896658299",
"236235642829772408714705827501257948716",
"271260922543403579260539408066176308780",
"309436806224739993960620404125564150404",
"191229499333905922462328067382505205029",
"250167760573045994779390696854832786263",
"320822312088152837135868628603868768441",
"99060928731039015239830149504972293976",
"334560362680946908515341511688693111174",
"306227087897403096026882036116439169772",
"238041964571775190111910493655496484416",
"211743511803180847236701382269864479690",
"220841316434309923906632736806851841113",
"288570808894559650344079249467518213164",
"251799619556983107043683049895092762295",
"230008708341940381892567601146640967079",
"71851921228057362654021882073390146868"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/l2tp/l2tp_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b2c59720e65885a394a017d0cf9cab118914682",
"id": "CVE-2023-53020-2915ffc0",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"81203019483778037833983222310784909202",
"27707684922399675591787362137326887573",
"274866530259093497296718872401914472797",
"333238411611240721809923810595261393974",
"190055022644985386869665242178818367080",
"282678688651668322439676137233841579999",
"242485930944893274621912860491071088688",
"331817907932597601891986281084107552877",
"38914643839654979979452473000698832918",
"330581827559828850087692769990017556885",
"325558989949580746671305241357338063117",
"129948838027393952700238643756832696265",
"261036051037459340271568631857793937311",
"253684403358398311864024551605896658299",
"236235642829772408714705827501257948716",
"271260922543403579260539408066176308780",
"309436806224739993960620404125564150404",
"191229499333905922462328067382505205029",
"250167760573045994779390696854832786263",
"320822312088152837135868628603868768441",
"99060928731039015239830149504972293976",
"334560362680946908515341511688693111174",
"306227087897403096026882036116439169772",
"238041964571775190111910493655496484416",
"211743511803180847236701382269864479690",
"220841316434309923906632736806851841113",
"288570808894559650344079249467518213164",
"251799619556983107043683049895092762295",
"230008708341940381892567601146640967079",
"71851921228057362654021882073390146868"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/l2tp/l2tp_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cef0845b6dcfa2f6c2c832e7f9622551456c741d",
"id": "CVE-2023-53020-2ddeb24b",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 1735.0,
"function_hash": "13067781470044613013393858880389745052"
},
"signature_version": "v1",
"target": {
"function": "l2tp_tunnel_register",
"file": "net/l2tp/l2tp_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0b2c59720e65885a394a017d0cf9cab118914682",
"id": "CVE-2023-53020-3b2ee4e6",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"81203019483778037833983222310784909202",
"27707684922399675591787362137326887573",
"274866530259093497296718872401914472797",
"333238411611240721809923810595261393974",
"190055022644985386869665242178818367080",
"282678688651668322439676137233841579999",
"242485930944893274621912860491071088688",
"331817907932597601891986281084107552877",
"38914643839654979979452473000698832918",
"330581827559828850087692769990017556885",
"325558989949580746671305241357338063117",
"129948838027393952700238643756832696265",
"261036051037459340271568631857793937311",
"253684403358398311864024551605896658299",
"236235642829772408714705827501257948716",
"271260922543403579260539408066176308780",
"309436806224739993960620404125564150404",
"191229499333905922462328067382505205029",
"250167760573045994779390696854832786263",
"320822312088152837135868628603868768441",
"99060928731039015239830149504972293976",
"334560362680946908515341511688693111174",
"306227087897403096026882036116439169772",
"238041964571775190111910493655496484416",
"211743511803180847236701382269864479690",
"220841316434309923906632736806851841113",
"288570808894559650344079249467518213164",
"251799619556983107043683049895092762295",
"230008708341940381892567601146640967079",
"71851921228057362654021882073390146868"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/l2tp/l2tp_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77e8ed776cdb1a24b2aab8fe7c6f1f154235e1ce",
"id": "CVE-2023-53020-551a19f6",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 1735.0,
"function_hash": "13067781470044613013393858880389745052"
},
"signature_version": "v1",
"target": {
"function": "l2tp_tunnel_register",
"file": "net/l2tp/l2tp_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@77e8ed776cdb1a24b2aab8fe7c6f1f154235e1ce",
"id": "CVE-2023-53020-d988b9ce",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 1735.0,
"function_hash": "13067781470044613013393858880389745052"
},
"signature_version": "v1",
"target": {
"function": "l2tp_tunnel_register",
"file": "net/l2tp/l2tp_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d77e5c0ad79004b5ef901895437e9cce6dfcc7e",
"id": "CVE-2023-53020-ec31b430",
"deprecated": false
},
{
"signature_type": "Function",
"digest": {
"length": 1735.0,
"function_hash": "13067781470044613013393858880389745052"
},
"signature_version": "v1",
"target": {
"function": "l2tp_tunnel_register",
"file": "net/l2tp/l2tp_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cef0845b6dcfa2f6c2c832e7f9622551456c741d",
"id": "CVE-2023-53020-ee00b9c4",
"deprecated": false
},
{
"signature_type": "Line",
"digest": {
"line_hashes": [
"81203019483778037833983222310784909202",
"27707684922399675591787362137326887573",
"274866530259093497296718872401914472797",
"333238411611240721809923810595261393974",
"190055022644985386869665242178818367080",
"282678688651668322439676137233841579999",
"242485930944893274621912860491071088688",
"331817907932597601891986281084107552877",
"38914643839654979979452473000698832918",
"330581827559828850087692769990017556885",
"325558989949580746671305241357338063117",
"129948838027393952700238643756832696265",
"261036051037459340271568631857793937311",
"253684403358398311864024551605896658299",
"236235642829772408714705827501257948716",
"271260922543403579260539408066176308780",
"309436806224739993960620404125564150404",
"191229499333905922462328067382505205029",
"250167760573045994779390696854832786263",
"320822312088152837135868628603868768441",
"99060928731039015239830149504972293976",
"334560362680946908515341511688693111174",
"306227087897403096026882036116439169772",
"238041964571775190111910493655496484416",
"211743511803180847236701382269864479690",
"220841316434309923906632736806851841113",
"288570808894559650344079249467518213164",
"251799619556983107043683049895092762295",
"230008708341940381892567601146640967079",
"71851921228057362654021882073390146868"
],
"threshold": 0.9
},
"signature_version": "v1",
"target": {
"file": "net/l2tp/l2tp_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2d77e5c0ad79004b5ef901895437e9cce6dfcc7e",
"id": "CVE-2023-53020-f37dad6e",
"deprecated": false
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53020.json"