In the Linux kernel, the following vulnerability has been resolved:
netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
Eric Dumazet says: nfconntrackdccp_packet() has an unique:
dh = skbheaderpointer(skb, dataoff, sizeof(dh), &dh);
And nothing more is 'pulled' from the packet, depending on the content. dh->dccphdoff, and/or dh->dccphx ...) So dccpackseq() is happily reading stuff past the _dh buffer.
BUG: KASAN: stack-out-of-bounds in nfconntrackdccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 [..]
Fix this by increasing the stack buffer to also include room for the extra sequence numbers and all the known dccp packet type headers, then pull again after the initial validation of the basic header.
While at it, mark packets invalid that lack 48bit sequence bit but where RFC says the type MUST use them.
Compile tested only.
v2: first skbheaderpointer() now needs to adjust the size to only pull the generic header. (Eric)
Heads-up: I intend to remove dccp conntrack support later this year.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53333.json"
}"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53333.json"
[
{
"id": "CVE-2023-53333-00f2ee83",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@337fdce450637ea663bc816edc2ba81e5cdad02e",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "216343058642649487550608715393757677918",
"length": 2429.0
},
"target": {
"function": "nf_conntrack_dccp_packet",
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-02d8d9ca",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c052797ac36813419ad3bfa54cb8615db4b41f15",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11593223847775709853444142991544037467",
"79426671346644887118789327018201784197",
"285913395675500349537702435615810976086",
"820477183744508266636097191440518755",
"118383094947315710549425258114951859860",
"123898631085769092425977731701993192826",
"156444356580388781430289752830286612543",
"229871836767802548960436738652631864678",
"204529289387016275660550970135724605948",
"215563960684099633944738103022939328303",
"258075207250978468462467935209827187844",
"206860140479998375326568971761185115282",
"312463499335724314482354898621072405324",
"220322828966697057260372886099047632589",
"167215717994580683023348643049495850151",
"189584181895369343014679525373047221672",
"179770806376447080049431126264291613439",
"97341317166121723733462051049833171649",
"148540345782425594481812087397005917520",
"332592662185978142651547833633561994572",
"333477478411179154698230098409707582819",
"83872791959970446940066303004490947747",
"226631513623994200900713736044830703145",
"334894576687285883083648593697974453771",
"333446833404730724074620119875764299640",
"227804690338480929301062867916928746824",
"75431274063039332748128717589188211508",
"261934814158887440793846442061183730228",
"239299701359475614711665780422300739223",
"135612542521385465026334571809290460991",
"216321100620008711872814999113328172324",
"224300336386691462936486166501489407248",
"131137606913172897702868116386074418441",
"330830503981997786862380347677901787825"
]
},
"target": {
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-0886ace4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c0980493beed3a80d6329c44ab293dc8c032927",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "306697854976232845563512950578739088264",
"length": 2453.0
},
"target": {
"function": "nf_conntrack_dccp_packet",
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-0c011074",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@337fdce450637ea663bc816edc2ba81e5cdad02e",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "277148851053827165855436387586394754599",
"length": 980.0
},
"target": {
"function": "dccp_error",
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-1b20e18c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c618daa5038712c4a4ef8923905a2ea1b8836a1",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "225775724475342073063268207331737157183",
"length": 959.0
},
"target": {
"function": "dccp_error",
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-1ccf763d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11593223847775709853444142991544037467",
"79426671346644887118789327018201784197",
"285913395675500349537702435615810976086",
"820477183744508266636097191440518755",
"118383094947315710549425258114951859860",
"123898631085769092425977731701993192826",
"156444356580388781430289752830286612543",
"229871836767802548960436738652631864678",
"204529289387016275660550970135724605948",
"215563960684099633944738103022939328303",
"258075207250978468462467935209827187844",
"206860140479998375326568971761185115282",
"312463499335724314482354898621072405324",
"220322828966697057260372886099047632589",
"167215717994580683023348643049495850151",
"189584181895369343014679525373047221672",
"179770806376447080049431126264291613439",
"97341317166121723733462051049833171649",
"148540345782425594481812087397005917520",
"332592662185978142651547833633561994572",
"333477478411179154698230098409707582819",
"83872791959970446940066303004490947747",
"226631513623994200900713736044830703145",
"334894576687285883083648593697974453771",
"333446833404730724074620119875764299640",
"227804690338480929301062867916928746824",
"75431274063039332748128717589188211508",
"261934814158887440793846442061183730228",
"239299701359475614711665780422300739223",
"135612542521385465026334571809290460991",
"216321100620008711872814999113328172324",
"224300336386691462936486166501489407248",
"131137606913172897702868116386074418441",
"330830503981997786862380347677901787825"
]
},
"target": {
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-32c61e9f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c0980493beed3a80d6329c44ab293dc8c032927",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "225775724475342073063268207331737157183",
"length": 959.0
},
"target": {
"function": "dccp_error",
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-5374efc8",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c052797ac36813419ad3bfa54cb8615db4b41f15",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "306697854976232845563512950578739088264",
"length": 2453.0
},
"target": {
"function": "nf_conntrack_dccp_packet",
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-63bb1fd2",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9bdcda7abaf22f6453e5b5efb7eb4e524095d5d8",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "216343058642649487550608715393757677918",
"length": 2429.0
},
"target": {
"function": "nf_conntrack_dccp_packet",
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-82568c43",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26bd1f210d3783a691052c51d76bb8a8bbd24c67",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11593223847775709853444142991544037467",
"79426671346644887118789327018201784197",
"285913395675500349537702435615810976086",
"820477183744508266636097191440518755",
"118383094947315710549425258114951859860",
"123898631085769092425977731701993192826",
"156444356580388781430289752830286612543",
"229871836767802548960436738652631864678",
"204529289387016275660550970135724605948",
"215563960684099633944738103022939328303",
"258075207250978468462467935209827187844",
"206860140479998375326568971761185115282",
"312463499335724314482354898621072405324",
"220322828966697057260372886099047632589",
"167215717994580683023348643049495850151",
"189584181895369343014679525373047221672",
"179770806376447080049431126264291613439",
"97341317166121723733462051049833171649",
"148540345782425594481812087397005917520",
"332592662185978142651547833633561994572",
"333477478411179154698230098409707582819",
"83872791959970446940066303004490947747",
"226631513623994200900713736044830703145",
"334894576687285883083648593697974453771",
"333446833404730724074620119875764299640",
"227804690338480929301062867916928746824",
"75431274063039332748128717589188211508",
"261934814158887440793846442061183730228",
"239299701359475614711665780422300739223",
"135612542521385465026334571809290460991",
"216321100620008711872814999113328172324",
"224300336386691462936486166501489407248",
"131137606913172897702868116386074418441",
"330830503981997786862380347677901787825"
]
},
"target": {
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-857bb034",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "306697854976232845563512950578739088264",
"length": 2453.0
},
"target": {
"function": "nf_conntrack_dccp_packet",
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-95c63388",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c0980493beed3a80d6329c44ab293dc8c032927",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11593223847775709853444142991544037467",
"79426671346644887118789327018201784197",
"285913395675500349537702435615810976086",
"820477183744508266636097191440518755",
"118383094947315710549425258114951859860",
"123898631085769092425977731701993192826",
"156444356580388781430289752830286612543",
"229871836767802548960436738652631864678",
"204529289387016275660550970135724605948",
"215563960684099633944738103022939328303",
"258075207250978468462467935209827187844",
"206860140479998375326568971761185115282",
"312463499335724314482354898621072405324",
"220322828966697057260372886099047632589",
"167215717994580683023348643049495850151",
"189584181895369343014679525373047221672",
"179770806376447080049431126264291613439",
"97341317166121723733462051049833171649",
"148540345782425594481812087397005917520",
"332592662185978142651547833633561994572",
"333477478411179154698230098409707582819",
"83872791959970446940066303004490947747",
"226631513623994200900713736044830703145",
"334894576687285883083648593697974453771",
"333446833404730724074620119875764299640",
"227804690338480929301062867916928746824",
"75431274063039332748128717589188211508",
"261934814158887440793846442061183730228",
"239299701359475614711665780422300739223",
"135612542521385465026334571809290460991",
"216321100620008711872814999113328172324",
"224300336386691462936486166501489407248",
"131137606913172897702868116386074418441",
"330830503981997786862380347677901787825"
]
},
"target": {
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-9f30bf03",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c618daa5038712c4a4ef8923905a2ea1b8836a1",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "306697854976232845563512950578739088264",
"length": 2453.0
},
"target": {
"function": "nf_conntrack_dccp_packet",
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-af505f7c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26bd1f210d3783a691052c51d76bb8a8bbd24c67",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "225775724475342073063268207331737157183",
"length": 959.0
},
"target": {
"function": "dccp_error",
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-afcde58e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff0a3a7d52ff7282dbd183e7fc29a1fe386b0c30",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "225775724475342073063268207331737157183",
"length": 959.0
},
"target": {
"function": "dccp_error",
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-bb45f399",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9bdcda7abaf22f6453e5b5efb7eb4e524095d5d8",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "277148851053827165855436387586394754599",
"length": 980.0
},
"target": {
"function": "dccp_error",
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-dcaf884b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c052797ac36813419ad3bfa54cb8615db4b41f15",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "225775724475342073063268207331737157183",
"length": 959.0
},
"target": {
"function": "dccp_error",
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-e9c49ff0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@337fdce450637ea663bc816edc2ba81e5cdad02e",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11593223847775709853444142991544037467",
"79426671346644887118789327018201784197",
"285913395675500349537702435615810976086",
"820477183744508266636097191440518755",
"118383094947315710549425258114951859860",
"123898631085769092425977731701993192826",
"156444356580388781430289752830286612543",
"229871836767802548960436738652631864678",
"204529289387016275660550970135724605948",
"215563960684099633944738103022939328303",
"258075207250978468462467935209827187844",
"206860140479998375326568971761185115282",
"312463499335724314482354898621072405324",
"218420947322252785603239713335232874604",
"117831538149041431787707124745359206670",
"97341317166121723733462051049833171649",
"148540345782425594481812087397005917520",
"332592662185978142651547833633561994572",
"333477478411179154698230098409707582819",
"83872791959970446940066303004490947747",
"226631513623994200900713736044830703145",
"334894576687285883083648593697974453771",
"333446833404730724074620119875764299640",
"227804690338480929301062867916928746824",
"75431274063039332748128717589188211508",
"261934814158887440793846442061183730228",
"239299701359475614711665780422300739223",
"135612542521385465026334571809290460991",
"216321100620008711872814999113328172324",
"224300336386691462936486166501489407248",
"276730272812160626860471555819816212090",
"201522100449204833755905946831838411938"
]
},
"target": {
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-ea1ca343",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9bdcda7abaf22f6453e5b5efb7eb4e524095d5d8",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11593223847775709853444142991544037467",
"79426671346644887118789327018201784197",
"285913395675500349537702435615810976086",
"820477183744508266636097191440518755",
"118383094947315710549425258114951859860",
"123898631085769092425977731701993192826",
"156444356580388781430289752830286612543",
"229871836767802548960436738652631864678",
"204529289387016275660550970135724605948",
"215563960684099633944738103022939328303",
"258075207250978468462467935209827187844",
"206860140479998375326568971761185115282",
"312463499335724314482354898621072405324",
"218420947322252785603239713335232874604",
"117831538149041431787707124745359206670",
"97341317166121723733462051049833171649",
"148540345782425594481812087397005917520",
"332592662185978142651547833633561994572",
"333477478411179154698230098409707582819",
"83872791959970446940066303004490947747",
"226631513623994200900713736044830703145",
"334894576687285883083648593697974453771",
"333446833404730724074620119875764299640",
"227804690338480929301062867916928746824",
"75431274063039332748128717589188211508",
"261934814158887440793846442061183730228",
"239299701359475614711665780422300739223",
"135612542521385465026334571809290460991",
"216321100620008711872814999113328172324",
"224300336386691462936486166501489407248",
"276730272812160626860471555819816212090",
"201522100449204833755905946831838411938"
]
},
"target": {
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-ed7bb3db",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26bd1f210d3783a691052c51d76bb8a8bbd24c67",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"digest": {
"function_hash": "306697854976232845563512950578739088264",
"length": 2453.0
},
"target": {
"function": "nf_conntrack_dccp_packet",
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
},
{
"id": "CVE-2023-53333-f3820bc4",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5c618daa5038712c4a4ef8923905a2ea1b8836a1",
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"11593223847775709853444142991544037467",
"79426671346644887118789327018201784197",
"285913395675500349537702435615810976086",
"820477183744508266636097191440518755",
"118383094947315710549425258114951859860",
"123898631085769092425977731701993192826",
"156444356580388781430289752830286612543",
"229871836767802548960436738652631864678",
"204529289387016275660550970135724605948",
"215563960684099633944738103022939328303",
"258075207250978468462467935209827187844",
"206860140479998375326568971761185115282",
"312463499335724314482354898621072405324",
"220322828966697057260372886099047632589",
"167215717994580683023348643049495850151",
"189584181895369343014679525373047221672",
"179770806376447080049431126264291613439",
"97341317166121723733462051049833171649",
"148540345782425594481812087397005917520",
"332592662185978142651547833633561994572",
"333477478411179154698230098409707582819",
"83872791959970446940066303004490947747",
"226631513623994200900713736044830703145",
"334894576687285883083648593697974453771",
"333446833404730724074620119875764299640",
"227804690338480929301062867916928746824",
"75431274063039332748128717589188211508",
"261934814158887440793846442061183730228",
"239299701359475614711665780422300739223",
"135612542521385465026334571809290460991",
"216321100620008711872814999113328172324",
"224300336386691462936486166501489407248",
"131137606913172897702868116386074418441",
"330830503981997786862380347677901787825"
]
},
"target": {
"file": "net/netfilter/nf_conntrack_proto_dccp.c"
}
}
]