In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix UaF in listener shutdown
As reported by Christoph after having refactored the passive socket initialization, the mptcp listener shutdown path is prone to an UaF issue.
BUG: KASAN: use-after-free in rawspinlockbh+0x73/0xe0 Write of size 4 at addr ffff88810cb23098 by task syz-executor731/1266
CPU: 1 PID: 1266 Comm: syz-executor731 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dumpstacklvl+0x6e/0x91 printreport+0x16a/0x46f kasanreport+0xad/0x130 kasancheckrange+0x14a/0x1a0 rawspinlockbh+0x73/0xe0 subflowerrorreport+0x6d/0x110 skerrorreport+0x3b/0x190 tcpdisconnect+0x138c/0x1aa0 inetchildforget+0x6f/0x2e0 inetcsklistenstop+0x209/0x1060 _mptcpclosessk+0x52d/0x610 mptcpdestroycommon+0x165/0x640 mptcpdestroy+0x13/0x80 _mptcpdestroysock+0xe7/0x270 _mptcpclose+0x70e/0x9b0 mptcpclose+0x2b/0x150 inetrelease+0xe9/0x1f0 _sockrelease+0xd2/0x280 sockclose+0x15/0x20 _fput+0x252/0xa20 taskworkrun+0x169/0x250 exittousermodeprepare+0x113/0x120 syscallexittousermode+0x1d/0x40 dosyscall64+0x48/0x90 entrySYSCALL64after_hwframe+0x72/0xdc
The msk grace period can legitly expire in between the last reference count dropped in mptcpsubflowqueueclean() and the later eventual access in inetcsklistenstop()
After the previous patch we don't need anymore special-casing msk listener socket cleanup: the mptcp worker will process each of the unaccepted msk sockets.
Just drop the now unnecessary code.
Please note this commit depends on the two parent ones:
mptcp: refactor passive socket initialization mptcp: use the workqueue to destroy unaccepted sockets
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53088.json",
"cna_assigner": "Linux"
}[
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/subflow.c",
"function": "mptcp_subflow_queue_clean"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f4f4cf5d32f10543deb946a37111e714579511e",
"signature_type": "Function",
"id": "CVE-2023-53088-0d22e556",
"deprecated": false,
"digest": {
"function_hash": "79089095385118780331265059373377126147",
"length": 1093.0
}
},
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/protocol.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5564be74a22a61855f8b8c100d8c4abb003bb792",
"signature_type": "Line",
"id": "CVE-2023-53088-20c1c13b",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"208921428328342903945269982061174396608",
"83620918948386287186399401059969730110",
"154424921655174161094106192463115311892",
"325238732501076400987198310024837533256"
]
}
},
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/subflow.c",
"function": "mptcp_subflow_queue_clean"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5564be74a22a61855f8b8c100d8c4abb003bb792",
"signature_type": "Function",
"id": "CVE-2023-53088-2727fdbe",
"deprecated": false,
"digest": {
"function_hash": "79089095385118780331265059373377126147",
"length": 1093.0
}
},
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/protocol.c",
"function": "__mptcp_close_ssk"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a3f4f1f9c27215e4ddcd312558342e57b93e518",
"signature_type": "Function",
"id": "CVE-2023-53088-356430b3",
"deprecated": false,
"digest": {
"function_hash": "72725656655218159180166628151402922465",
"length": 1322.0
}
},
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/protocol.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a3f4f1f9c27215e4ddcd312558342e57b93e518",
"signature_type": "Line",
"id": "CVE-2023-53088-489c5e8c",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"316168200107166195754358679304184238866",
"168615351691174707029336657098093287123",
"274682149697271503236196249936985050098",
"152287293464414105523360683200030921081",
"91697559070144261627284995156275440296",
"60965793200898327354246251789494061875",
"307464234971325450156597467206438666871",
"68320934787965375111624879220569783943",
"303289249209682506427402400156996431040"
]
}
},
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/subflow.c",
"function": "mptcp_subflow_queue_clean"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a3f4f1f9c27215e4ddcd312558342e57b93e518",
"signature_type": "Function",
"id": "CVE-2023-53088-4ca002b7",
"deprecated": false,
"digest": {
"function_hash": "79089095385118780331265059373377126147",
"length": 1093.0
}
},
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/protocol.c",
"function": "__mptcp_close_ssk"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f4f4cf5d32f10543deb946a37111e714579511e",
"signature_type": "Function",
"id": "CVE-2023-53088-4e8929c4",
"deprecated": false,
"digest": {
"function_hash": "72725656655218159180166628151402922465",
"length": 1322.0
}
},
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/subflow.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5564be74a22a61855f8b8c100d8c4abb003bb792",
"signature_type": "Line",
"id": "CVE-2023-53088-950e75ed",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"129339318234035539007387719143761103102",
"71393536954941600849449582538664555787",
"299794978773330032689657029542975488012",
"323964784091145190884435266197223111755",
"125625985365302327086130792165961400096",
"182654453094728060218349893940666019532",
"309384556279435421229072386692887211903",
"327424676198914628974670674860546898228",
"9729728626261963958594201299354573265",
"271828409181796626229474708331425227164",
"57334394445148881314132228006722948443",
"262846108703465990435314422960336857023",
"26835571127506919365192533368653103768",
"182978823081907508306310354727248877895",
"315345183507695374344308390500051027896",
"53338167385318463942845011304726817615",
"157249611452735868695421901084291740034",
"310699347253752883665095339019964405116",
"22166206186063142958068884397203826806",
"25681966449978585462887389881449848503",
"128619273503448897978534687860353515126",
"263151602381341084235370507209553625679",
"170734292287270889741694288759403821467",
"244288472965177909282855257283040036871",
"22387024284843515481942919193119666216",
"261362455598573109799857492293574600622",
"154410230629528965506322887402499556462",
"307180432111574776088538315345832303789",
"288032309136026931467016299720137871461",
"137446424163053407401886897054969151873",
"52286671999389696641655265889306337357",
"36550861339741295647686610385308984748",
"27986506476377430464994701624326262768",
"264688491905061522723506740570977539013",
"230028043973214337856141310416041049495",
"312000716460811601234018467843016039982",
"326919672083044169706817543698295758586",
"217299398517245835769747519986690263302",
"191244865730257143485324739514437973983",
"105796162477653376647276903141893858460",
"234977268025298295296869683064835706006",
"195022040899358812877442831116894884774",
"273730259381362541851496613005427367294",
"203346392472122624972443236279878931651",
"285222193688558129911362768310632674541",
"238467748278205104826088565984800057484",
"312904954889818865303418991738523828896"
]
}
},
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/subflow.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a3f4f1f9c27215e4ddcd312558342e57b93e518",
"signature_type": "Line",
"id": "CVE-2023-53088-9cf996b2",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"129339318234035539007387719143761103102",
"71393536954941600849449582538664555787",
"299794978773330032689657029542975488012",
"323964784091145190884435266197223111755",
"125625985365302327086130792165961400096",
"182654453094728060218349893940666019532",
"309384556279435421229072386692887211903",
"327424676198914628974670674860546898228",
"9729728626261963958594201299354573265",
"271828409181796626229474708331425227164",
"57334394445148881314132228006722948443",
"262846108703465990435314422960336857023",
"26835571127506919365192533368653103768",
"182978823081907508306310354727248877895",
"315345183507695374344308390500051027896",
"53338167385318463942845011304726817615",
"157249611452735868695421901084291740034",
"310699347253752883665095339019964405116",
"22166206186063142958068884397203826806",
"25681966449978585462887389881449848503",
"128619273503448897978534687860353515126",
"263151602381341084235370507209553625679",
"170734292287270889741694288759403821467",
"244288472965177909282855257283040036871",
"22387024284843515481942919193119666216",
"261362455598573109799857492293574600622",
"154410230629528965506322887402499556462",
"307180432111574776088538315345832303789",
"288032309136026931467016299720137871461",
"137446424163053407401886897054969151873",
"52286671999389696641655265889306337357",
"36550861339741295647686610385308984748",
"27986506476377430464994701624326262768",
"264688491905061522723506740570977539013",
"230028043973214337856141310416041049495",
"312000716460811601234018467843016039982",
"326919672083044169706817543698295758586",
"217299398517245835769747519986690263302",
"191244865730257143485324739514437973983",
"105796162477653376647276903141893858460",
"234977268025298295296869683064835706006",
"195022040899358812877442831116894884774",
"273730259381362541851496613005427367294",
"203346392472122624972443236279878931651",
"285222193688558129911362768310632674541",
"238467748278205104826088565984800057484",
"312904954889818865303418991738523828896"
]
}
},
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/protocol.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f4f4cf5d32f10543deb946a37111e714579511e",
"signature_type": "Line",
"id": "CVE-2023-53088-accc028e",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"316168200107166195754358679304184238866",
"168615351691174707029336657098093287123",
"274682149697271503236196249936985050098",
"152287293464414105523360683200030921081",
"91697559070144261627284995156275440296",
"60965793200898327354246251789494061875",
"307464234971325450156597467206438666871",
"68320934787965375111624879220569783943",
"303289249209682506427402400156996431040"
]
}
},
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/protocol.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5564be74a22a61855f8b8c100d8c4abb003bb792",
"signature_type": "Line",
"id": "CVE-2023-53088-b7f5edb5",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"316168200107166195754358679304184238866",
"168615351691174707029336657098093287123",
"274682149697271503236196249936985050098",
"152287293464414105523360683200030921081",
"176561728070666027566855568465441506682",
"317884623940960963645533681691409443454",
"330699047348279672654615464748675375109",
"303289249209682506427402400156996431040"
]
}
},
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/protocol.c",
"function": "__mptcp_close_ssk"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5564be74a22a61855f8b8c100d8c4abb003bb792",
"signature_type": "Function",
"id": "CVE-2023-53088-bcc9ac5f",
"deprecated": false,
"digest": {
"function_hash": "167630439104490399066452474367173821473",
"length": 1271.0
}
},
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/protocol.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0a3f4f1f9c27215e4ddcd312558342e57b93e518",
"signature_type": "Line",
"id": "CVE-2023-53088-be7e6b4c",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"208921428328342903945269982061174396608",
"83620918948386287186399401059969730110",
"154424921655174161094106192463115311892",
"325238732501076400987198310024837533256"
]
}
},
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/subflow.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f4f4cf5d32f10543deb946a37111e714579511e",
"signature_type": "Line",
"id": "CVE-2023-53088-c9d3380f",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"129339318234035539007387719143761103102",
"71393536954941600849449582538664555787",
"299794978773330032689657029542975488012",
"323964784091145190884435266197223111755",
"125625985365302327086130792165961400096",
"182654453094728060218349893940666019532",
"309384556279435421229072386692887211903",
"327424676198914628974670674860546898228",
"9729728626261963958594201299354573265",
"271828409181796626229474708331425227164",
"57334394445148881314132228006722948443",
"262846108703465990435314422960336857023",
"26835571127506919365192533368653103768",
"182978823081907508306310354727248877895",
"315345183507695374344308390500051027896",
"53338167385318463942845011304726817615",
"157249611452735868695421901084291740034",
"310699347253752883665095339019964405116",
"22166206186063142958068884397203826806",
"25681966449978585462887389881449848503",
"128619273503448897978534687860353515126",
"263151602381341084235370507209553625679",
"170734292287270889741694288759403821467",
"244288472965177909282855257283040036871",
"22387024284843515481942919193119666216",
"261362455598573109799857492293574600622",
"154410230629528965506322887402499556462",
"307180432111574776088538315345832303789",
"288032309136026931467016299720137871461",
"137446424163053407401886897054969151873",
"52286671999389696641655265889306337357",
"36550861339741295647686610385308984748",
"27986506476377430464994701624326262768",
"264688491905061522723506740570977539013",
"230028043973214337856141310416041049495",
"312000716460811601234018467843016039982",
"326919672083044169706817543698295758586",
"217299398517245835769747519986690263302",
"191244865730257143485324739514437973983",
"105796162477653376647276903141893858460",
"234977268025298295296869683064835706006",
"195022040899358812877442831116894884774",
"273730259381362541851496613005427367294",
"203346392472122624972443236279878931651",
"285222193688558129911362768310632674541",
"238467748278205104826088565984800057484",
"312904954889818865303418991738523828896"
]
}
},
{
"signature_version": "v1",
"target": {
"file": "net/mptcp/protocol.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0f4f4cf5d32f10543deb946a37111e714579511e",
"signature_type": "Line",
"id": "CVE-2023-53088-d55893df",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"208921428328342903945269982061174396608",
"83620918948386287186399401059969730110",
"154424921655174161094106192463115311892",
"325238732501076400987198310024837533256"
]
}
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53088.json"