CVE-2023-53585
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-53585
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53585.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-53585
- Downstream
- Published
- 2025-10-04T15:44:01Z
- Modified
- 2025-10-16T20:01:11.299693Z
- Summary
- bpf: reject unhashed sockets in bpf_sk_assign
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
bpf: reject unhashed sockets in bpfskassign
The semantics for bpfskassign are as follows:
sk = some_lookup_func() bpf_sk_assign(skb, sk) bpf_sk_release(sk)That is, the sk is not consumed by bpfskassign. The function therefore needs to make sure that sk lives long enough to be consumed from _inetlookup_skb. The path through the stack for a TCPv4 packet is roughly:
netifreceiveskbcore: takes RCU read lock _netifreceiveskbcore: schhandleingress: tcfclassify: bpfskassign() deliverptypelistskb: deliverskb: ippackettype->func == iprcv: iprcvcore: iprcvfinishcore: dstinput: iplocaldeliver: iplocaldeliverfinish: ipprotocoldeliverrcu: tcpv4rcv: _inetlookupskb: skbstealsock
The existing helper takes advantage of the fact that everything happens in the same RCU critical section: for sockets with SOCKRCUFREE set bpfskassign never takes a reference. skbstealsock then checks SOCKRCUFREE again and does sock_put if necessary.
This approach assumes that SOCKRCUFREE is never set on a sk between bpfskassign and skbstealsock, but this invariant is violated by unhashed UDP sockets. A new UDP socket is created in TCPCLOSE state but without SOCKRCUFREE set. That flag is only added in udplibgetport() which happens when a socket is bound.
When bpfskassign was added it wasn't possible to access unhashed UDP sockets from BPF, so this wasn't a problem. This changed in commit 0c48eefae712 ("sock_map: Lift socket state restriction for datagram sockets"), but the helper wasn't adjusted accordingly. The following sequence of events will therefore lead to a refcount leak:
- Add socket(AFINET, SOCKDGRAM) to a sockmap.
- Pull socket out of sockmap and bpfskassign it. Since SOCKRCUFREE is not set we increment the refcount.
- bind() or connect() the socket, setting SOCKRCUFREE.
- skbstealsock will now set refcounted = false due to SOCKRCUFREE.
- tcpv4rcv() skips sock_put().
Fix the problem by rejecting unhashed sockets in bpfskassign(). This matches the behaviour of _inetlookupskb which is ultimately the goal of bpfsk_assign().
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/3d4522f59fb748a54446846522941a4f09da63e9
- https://git.kernel.org/stable/c/67312adc96b5a585970d03b62412847afe2c6b01
- https://git.kernel.org/stable/c/791a12102e5191dcb6ce0b3a99d71b5a2802d12a
- https://git.kernel.org/stable/c/7dcbc0bb0e5cc1823923744befce59ac353135e6
- https://git.kernel.org/stable/c/8aa43cfbb68b25119d2ced14ec717173e2901fa2
- https://git.kernel.org/stable/c/c0ce0fb76610d5fad31f56f2ca8241a2a6717a1b
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedcf7fbe660f2dbd738ab58aea8e9b0ca6ad232449Fixed791a12102e5191dcb6ce0b3a99d71b5a2802d12a
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedcf7fbe660f2dbd738ab58aea8e9b0ca6ad232449Fixed7dcbc0bb0e5cc1823923744befce59ac353135e6
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedcf7fbe660f2dbd738ab58aea8e9b0ca6ad232449Fixedc0ce0fb76610d5fad31f56f2ca8241a2a6717a1b
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedcf7fbe660f2dbd738ab58aea8e9b0ca6ad232449Fixed8aa43cfbb68b25119d2ced14ec717173e2901fa2
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedcf7fbe660f2dbd738ab58aea8e9b0ca6ad232449Fixed3d4522f59fb748a54446846522941a4f09da63e9
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducedcf7fbe660f2dbd738ab58aea8e9b0ca6ad232449Fixed67312adc96b5a585970d03b62412847afe2c6b01