CVE-2023-53021
- Source
- https://cve.org/CVERecord?id=CVE-2023-53021
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53021.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-53021
- Downstream
- Published
- 2025-03-27T16:43:47.860Z
- Modified
- 2026-03-11T03:46:07.582303Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- net/sched: sch_taprio: fix possible use-after-free
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_taprio: fix possible use-after-free
syzbot reported a nasty crash [1] in nettxaction() which made little sense until we got a repro.
This repro installs a taprio qdisc, but providing an invalid TCA_RATE attribute.
qdisccreate() has to destroy the just initialized taprio qdisc, and tapriodestroy() is called.
However, the hrtimer used by taprio had already fired, therefore advance_sched() called _netifschedule().
Then nettxaction was trying to use a destroyed qdisc.
We can not undo the _netifschedule(), so we must wait until one cpu serviced the qdisc before we can proceed.
Many thanks to Alexander Potapenko for his help.
[1] BUG: KMSAN: uninit-value in queuedspintrylock include/asm-generic/qspinlock.h:94 [inline] BUG: KMSAN: uninit-value in dorawspin_trylock include/linux/spinlock.h:191 [inline] BUG: KMSAN: uninit-value in __rawspintrylock include/linux/spinlockapismp.h:89 [inline] BUG: KMSAN: uninit-value in rawspintrylock+0x92/0xa0 kernel/locking/spinlock.c:138 queuedspintrylock include/asm-generic/qspinlock.h:94 [inline] dorawspintrylock include/linux/spinlock.h:191 [inline] __rawspintrylock include/linux/spinlockapismp.h:89 [inline] rawspin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 spintrylock include/linux/spinlock.h:359 [inline] qdiscrunbegin include/net/schgeneric.h:187 [inline] qdiscrun+0xee/0x540 include/net/pktsched.h:125 nettxaction+0x77c/0x9a0 net/core/dev.c:5086 __dosoftirq+0x1cc/0x7fb kernel/softirq.c:571 runksoftirqd+0x2c/0x50 kernel/softirq.c:934 smpbootthreadfn+0x554/0x9f0 kernel/smpboot.c:164 kthread+0x31b/0x430 kernel/kthread.c:376 retfromfork+0x1f/0x30
Uninit was created at: slabpostallochook mm/slab.h:732 [inline] slaballoc_node mm/slub.c:3258 [inline] __kmallocnodetrackcaller+0x814/0x1250 mm/slub.c:4970 kmallocreserve net/core/skbuff.c:358 [inline] __allocskb+0x346/0xcf0 net/core/skbuff.c:430 allocskb include/linux/skbuff.h:1257 [inline] nlmsg_new include/net/netlink.h:953 [inline] netlinkack+0x5f3/0x12b0 net/netlink/afnetlink.c:2436 netlinkrcvskb+0x55d/0x6c0 net/netlink/afnetlink.c:2507 rtnetlinkrcv+0x30/0x40 net/core/rtnetlink.c:6108 netlinkunicastkernel net/netlink/afnetlink.c:1319 [inline] netlinkunicast+0xf3b/0x1270 net/netlink/afnetlink.c:1345 netlinksendmsg+0x1288/0x1440 net/netlink/afnetlink.c:1921 socksendmsgnosec net/socket.c:714 [inline] socksendmsg net/socket.c:734 [inline] ____sys_sendmsg+0xabc/0xe90 net/socket.c:2482 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2536 __sys_sendmsg net/socket.c:2565 [inline] __dosyssendmsg net/socket.c:2574 [inline] __sesyssendmsg net/socket.c:2572 [inline] __x64syssendmsg+0x367/0x540 net/socket.c:2572 dosyscallx64 arch/x86/entry/common.c:50 [inline] dosyscall64+0x3d/0xb0 arch/x86/entry/common.c:80 entrySYSCALL64afterhwframe+0x63/0xcd
CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 6.0.0-rc2-syzkaller-47461-gac3859c02d7f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53021.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/1200388a0b1c3c6fda48d4d2143db8f7e4ef5348
- https://git.kernel.org/stable/c/3a415d59c1dbec9d772dbfab2d2520d98360caae
- https://git.kernel.org/stable/c/c53acbf2facfdfabdc6e6984a1a38f5d38b606a1
- https://git.kernel.org/stable/c/c60fe70078d6e515f424cb868d07e00411b27fbc
- https://git.kernel.org/stable/c/d3b2d2820a005e43855fa71b80c4a4b194201c60
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53021.json
- https://nvd.nist.gov/vuln/detail/CVE-2023-53021
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced5a781ccbd19e4664babcbe4b4ead7aa2b9283d22Fixed1200388a0b1c3c6fda48d4d2143db8f7e4ef5348Fixedc60fe70078d6e515f424cb868d07e00411b27fbcFixedc53acbf2facfdfabdc6e6984a1a38f5d38b606a1Fixedd3b2d2820a005e43855fa71b80c4a4b194201c60Fixed3a415d59c1dbec9d772dbfab2d2520d98360caae
Affected versions
v4.*
v5.*
v6.*
Database specific
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53021.json"
vanir_signatures
[
{
"id": "CVE-2023-53021-118a830a",
"signature_version": "v1",
"target": {
"file": "include/net/sch_generic.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"98295454283547836948882898972269461673"
]
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1200388a0b1c3c6fda48d4d2143db8f7e4ef5348",
"deprecated": false
},
{
"id": "CVE-2023-53021-1da1a00f",
"signature_version": "v1",
"target": {
"file": "net/sched/sch_taprio.c",
"function": "taprio_destroy"
},
"digest": {
"function_hash": "287326553825580861450655244599233573018",
"length": 677.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1200388a0b1c3c6fda48d4d2143db8f7e4ef5348",
"deprecated": false
},
{
"id": "CVE-2023-53021-3add5816",
"signature_version": "v1",
"target": {
"file": "net/sched/sch_taprio.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"80259668856733453801066310885576460117",
"297178166720127800806093039336261940377",
"165208610166839847279642903357842517404",
"250235304839350660294155220760290173367",
"65574757442712922750091417593499561763",
"153620021877415985403523800096027464249",
"182844235977671408198179800129172022848",
"299812622563307893039033390925248888395"
]
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1200388a0b1c3c6fda48d4d2143db8f7e4ef5348",
"deprecated": false
},
{
"id": "CVE-2023-53021-9081aa47",
"signature_version": "v1",
"target": {
"file": "net/sched/sch_taprio.c",
"function": "taprio_reset"
},
"digest": {
"function_hash": "238940254640301470041361902093778995294",
"length": 362.0
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1200388a0b1c3c6fda48d4d2143db8f7e4ef5348",
"deprecated": false
}
]