CVE-2023-53635

It is observed that timeout of an unconfirmed conntrack: - Set by calling ctnetlinkchangetimeout(). As a result, nfct_time_stamp was wrongly added to ct->timeout twice. - Get by calling ctnetlinkdumptimeout(). As a result, nfct_time_stamp was wrongly subtracted.

Call Trace: <TASK> dumpstacklvl ctnetlinkdumptimeout _ctnetlinkgluebuild ctnetlinkgluebuild _nfqnlenqueuepacket nfqueue nfhookslow ipmcoutput ? _pfxipfinishoutput ipsendskb ? _pfxdstoutput udpsendskb udpsendmsg ? _pfxipgenericgetfrag socksendmsg

Separate the 2 cases in: - Setting ct->timeout in _nfctsettimeout(). - Getting ct->timeout in ctnetlinkdumptimeout().

Pablo appends:

Update ctnetlink to set up the timeout after the IPS_CONFIRMED flag is set on, otherwise conntrack creation via ctnetlink breaks.

Note that the problem described in this patch occurs since the introduction of the nfnetlink_queue conntrack support, select a sufficiently old Fixes: tag for -stable kernel to pick up this fix.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53635.json",
    "cna_assigner": "Linux"
}

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type: GIT
Repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events: Introduced

a4b4766c3cebb4018167e06b863d8e95b7274757

Fixed

80c5ba0078e20d926d11d0778f9a43902664ebf0

Fixed

ff5e4ac8dd7be7f1faba955c5779a68571eeb0f8

Fixed

f612ae1ab4793701caf39386fb3b7f4b3ef44e48

Fixed

73db1b8f2bb6725b7391e85aab41fdf592b3c0c1

Affected versions

v4.*

v4.10

v4.10-rc1

v4.10-rc2

v4.10-rc3

v4.10-rc4

v4.10-rc5

v4.10-rc6

v4.10-rc7

v4.10-rc8

v4.11

v4.11-rc1

v4.11-rc2

v4.11-rc3

v4.11-rc4

v4.11-rc5

v4.11-rc6

v4.11-rc7

v4.11-rc8

v4.12

v4.12-rc1

v4.12-rc2

v4.12-rc3

v4.12-rc4

v4.12-rc5

v4.12-rc6

v4.12-rc7

v4.13

v4.13-rc1

v4.13-rc2

v4.13-rc3

v4.13-rc4

v4.13-rc5

v4.13-rc6

v4.13-rc7

v4.14

v4.14-rc1

v4.14-rc2

v4.14-rc3

v4.14-rc4

v4.14-rc5

v4.14-rc6

v4.14-rc7

v4.14-rc8

v4.15

v4.15-rc1

v4.15-rc2

v4.15-rc3

v4.15-rc4

v4.15-rc5

v4.15-rc6

v4.15-rc7

v4.15-rc8

v4.15-rc9

v4.16

v4.16-rc1

v4.16-rc2

v4.16-rc3

v4.16-rc4

v4.16-rc5

v4.16-rc6

v4.16-rc7

v4.17

v4.17-rc1

v4.17-rc2

v4.17-rc3

v4.17-rc4

v4.17-rc5

v4.17-rc6

v4.17-rc7

v4.18

v4.18-rc1

v4.18-rc2

v4.18-rc3

v4.18-rc4

v4.18-rc5

v4.18-rc6

v4.18-rc7

v4.18-rc8

v4.19

v4.19-rc1

v4.19-rc2

v4.19-rc3

v4.19-rc4

v4.19-rc5

v4.19-rc6

v4.19-rc7

v4.19-rc8

v4.20

v4.20-rc1

v4.20-rc2

v4.20-rc3

v4.20-rc4

v4.20-rc5

v4.20-rc6

v4.20-rc7

v4.3

v4.3-rc4

v4.3-rc5

v4.3-rc6

v4.3-rc7

v4.4

v4.4-rc1

v4.4-rc2

v4.4-rc3

v4.4-rc4

v4.4-rc5

v4.4-rc6

v4.4-rc7

v4.4-rc8

v4.5

v4.5-rc1

v4.5-rc2

v4.5-rc3

v4.5-rc4

v4.5-rc5

v4.5-rc6

v4.5-rc7

v4.6

v4.6-rc1

v4.6-rc2

v4.6-rc3

v4.6-rc4

v4.6-rc5

v4.6-rc6

v4.6-rc7

v4.7

v4.7-rc1

v4.7-rc2

v4.7-rc3

v4.7-rc4

v4.7-rc5

v4.7-rc6

v4.7-rc7

v4.8

v4.8-rc1

v4.8-rc2

v4.8-rc3

v4.8-rc4

v4.8-rc5

v4.8-rc6

v4.8-rc7

v4.8-rc8

v4.9

v4.9-rc1

v4.9-rc2

v4.9-rc3

v4.9-rc4

v4.9-rc5

v4.9-rc6

v4.9-rc7

v4.9-rc8

v5.*

v5.0

v5.0-rc1

v5.0-rc2

v5.0-rc3

v5.0-rc4

v5.0-rc5

v5.0-rc6

v5.0-rc7

v5.0-rc8

v5.1

v5.1-rc1

v5.1-rc2

v5.1-rc3

v5.1-rc4

v5.1-rc5

v5.1-rc6

v5.1-rc7

v5.10

v5.10-rc1

v5.10-rc2

v5.10-rc3

v5.10-rc4

v5.10-rc5

v5.10-rc6

v5.10-rc7

v5.11

v5.11-rc1

v5.11-rc2

v5.11-rc3

v5.11-rc4

v5.11-rc5

v5.11-rc6

v5.11-rc7

v5.12

v5.12-rc1

v5.12-rc1-dontuse

v5.12-rc2

v5.12-rc3

v5.12-rc4

v5.12-rc5

v5.12-rc6

v5.12-rc7

v5.12-rc8

v5.13

v5.13-rc1

v5.13-rc2

v5.13-rc3

v5.13-rc4

v5.13-rc5

v5.13-rc6

v5.13-rc7

v5.14

v5.14-rc1

v5.14-rc2

v5.14-rc3

v5.14-rc4

v5.14-rc5

v5.14-rc6

v5.14-rc7

v5.15

v5.15-rc1

v5.15-rc2

v5.15-rc3

v5.15-rc4

v5.15-rc5

v5.15-rc6

v5.15-rc7

v5.16

v5.16-rc1

v5.16-rc2

v5.16-rc3

v5.16-rc4

v5.16-rc5

v5.16-rc6

v5.16-rc7

v5.16-rc8

v5.17

v5.17-rc1

v5.17-rc2

v5.17-rc3

v5.17-rc4

v5.17-rc5

v5.17-rc6

v5.17-rc7

v5.17-rc8

v5.18

v5.18-rc1

v5.18-rc2

v5.18-rc3

v5.18-rc4

v5.18-rc5

v5.18-rc6

v5.18-rc7

v5.19

v5.19-rc1

v5.19-rc2

v5.19-rc3

v5.19-rc4

v5.19-rc5

v5.19-rc6

v5.19-rc7

v5.19-rc8

v5.2

v5.2-rc1

v5.2-rc2

v5.2-rc3

v5.2-rc4

v5.2-rc5

v5.2-rc6

v5.2-rc7

v5.3

v5.3-rc1

v5.3-rc2

v5.3-rc3

v5.3-rc4

v5.3-rc5

v5.3-rc6

v5.3-rc7

v5.3-rc8

v5.4

v5.4-rc1

v5.4-rc2

v5.4-rc3

v5.4-rc4

v5.4-rc5

v5.4-rc6

v5.4-rc7

v5.4-rc8

v5.5

v5.5-rc1

v5.5-rc2

v5.5-rc3

v5.5-rc4

v5.5-rc5

v5.5-rc6

v5.5-rc7

v5.6

v5.6-rc1

v5.6-rc2

v5.6-rc3

v5.6-rc4

v5.6-rc5

v5.6-rc6

v5.6-rc7

v5.7

v5.7-rc1

v5.7-rc2

v5.7-rc3

v5.7-rc4

v5.7-rc5

v5.7-rc6

v5.7-rc7

v5.8

v5.8-rc1

v5.8-rc2

v5.8-rc3

v5.8-rc4

v5.8-rc5

v5.8-rc6

v5.8-rc7

v5.9

v5.9-rc1

v5.9-rc2

v5.9-rc3

v5.9-rc4

v5.9-rc5

v5.9-rc6

v5.9-rc7

v5.9-rc8

v6.*

v6.0

v6.0-rc1

v6.0-rc2

v6.0-rc3

v6.0-rc4

v6.0-rc5

v6.0-rc6

v6.0-rc7

v6.1

v6.1-rc1

v6.1-rc2

v6.1-rc3

v6.1-rc4

v6.1-rc5

v6.1-rc6

v6.1-rc7

v6.1-rc8

v6.1.1

v6.1.10

v6.1.11

v6.1.12

v6.1.13

v6.1.14

v6.1.15

v6.1.16

v6.1.17

v6.1.18

v6.1.19

v6.1.2

v6.1.20

v6.1.21

v6.1.22

v6.1.23

v6.1.24

v6.1.25

v6.1.26

v6.1.27

v6.1.3

v6.1.4

v6.1.5

v6.1.6

v6.1.7

v6.1.8

v6.1.9

v6.2

v6.2-rc1

v6.2-rc2

v6.2-rc3

v6.2-rc4

v6.2-rc5

v6.2-rc6

v6.2-rc7

v6.2-rc8

v6.2.1

v6.2.10

v6.2.11

v6.2.12

v6.2.13

v6.2.14

v6.2.2

v6.2.3

v6.2.4

v6.2.5

v6.2.6

v6.2.7

v6.2.8

v6.2.9

v6.3

v6.3-rc1

v6.3-rc2

v6.3-rc3

v6.3-rc4

v6.3-rc5

v6.3-rc6

v6.3-rc7

v6.3.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53635.json"

vanir_signatures

[
    {
        "id": "CVE-2023-53635-025ab874",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73db1b8f2bb6725b7391e85aab41fdf592b3c0c1",
        "target": {
            "file": "net/netfilter/nf_conntrack_netlink.c",
            "function": "ctnetlink_dump_timeout"
        },
        "digest": {
            "function_hash": "277939547089348100937359961906261277857",
            "length": 277.0
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53635-0791f0f2",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff5e4ac8dd7be7f1faba955c5779a68571eeb0f8",
        "target": {
            "file": "include/net/netfilter/nf_conntrack_core.h"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "226855776401203361634937029285997249724",
                "227579407936046680165768259569119649041",
                "14400493576007805705873629621768379279",
                "109665851498028990586584556469471576037"
            ]
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53635-2a7859b3",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73db1b8f2bb6725b7391e85aab41fdf592b3c0c1",
        "target": {
            "file": "include/net/netfilter/nf_conntrack_core.h"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "226855776401203361634937029285997249724",
                "227579407936046680165768259569119649041",
                "14400493576007805705873629621768379279",
                "109665851498028990586584556469471576037"
            ]
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53635-6b769b41",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80c5ba0078e20d926d11d0778f9a43902664ebf0",
        "target": {
            "file": "net/netfilter/nf_conntrack_netlink.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "14019883086724896519737438262254594043",
                "92286930044375614414605736594960559790",
                "50444062331884089850272046488887132016",
                "196129744913797159307919142204966983514",
                "204874171214254888655594889845053000964",
                "252709247435940465736991140485893903553",
                "324974597614907746515496285881885276358",
                "80892396819302431322473704047604798784",
                "153367769082598918830108620144837878941",
                "316364855762753722556903067310120169659",
                "31009610318108878051948610505833588187",
                "85831520068441029081350952647666302006"
            ]
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53635-75acaeb1",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f612ae1ab4793701caf39386fb3b7f4b3ef44e48",
        "target": {
            "file": "include/net/netfilter/nf_conntrack_core.h"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "226855776401203361634937029285997249724",
                "227579407936046680165768259569119649041",
                "14400493576007805705873629621768379279",
                "109665851498028990586584556469471576037"
            ]
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53635-7aa053ae",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff5e4ac8dd7be7f1faba955c5779a68571eeb0f8",
        "target": {
            "file": "net/netfilter/nf_conntrack_netlink.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "14019883086724896519737438262254594043",
                "92286930044375614414605736594960559790",
                "50444062331884089850272046488887132016",
                "196129744913797159307919142204966983514",
                "204874171214254888655594889845053000964",
                "252709247435940465736991140485893903553",
                "324974597614907746515496285881885276358",
                "80892396819302431322473704047604798784",
                "153367769082598918830108620144837878941",
                "316364855762753722556903067310120169659",
                "31009610318108878051948610505833588187",
                "85831520068441029081350952647666302006"
            ]
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53635-7cbb549e",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f612ae1ab4793701caf39386fb3b7f4b3ef44e48",
        "target": {
            "file": "include/net/netfilter/nf_conntrack_core.h",
            "function": "__nf_ct_set_timeout"
        },
        "digest": {
            "function_hash": "164951498392994704287571989190926872318",
            "length": 171.0
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53635-8b7e9dbd",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f612ae1ab4793701caf39386fb3b7f4b3ef44e48",
        "target": {
            "file": "net/netfilter/nf_conntrack_netlink.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "14019883086724896519737438262254594043",
                "92286930044375614414605736594960559790",
                "50444062331884089850272046488887132016",
                "196129744913797159307919142204966983514",
                "204874171214254888655594889845053000964",
                "252709247435940465736991140485893903553",
                "324974597614907746515496285881885276358",
                "80892396819302431322473704047604798784",
                "153367769082598918830108620144837878941",
                "316364855762753722556903067310120169659",
                "31009610318108878051948610505833588187",
                "85831520068441029081350952647666302006"
            ]
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53635-9df42e56",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73db1b8f2bb6725b7391e85aab41fdf592b3c0c1",
        "target": {
            "file": "net/netfilter/nf_conntrack_netlink.c"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "14019883086724896519737438262254594043",
                "92286930044375614414605736594960559790",
                "50444062331884089850272046488887132016",
                "196129744913797159307919142204966983514",
                "204874171214254888655594889845053000964",
                "252709247435940465736991140485893903553",
                "324974597614907746515496285881885276358",
                "80892396819302431322473704047604798784",
                "153367769082598918830108620144837878941",
                "316364855762753722556903067310120169659",
                "31009610318108878051948610505833588187",
                "85831520068441029081350952647666302006"
            ]
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53635-ae6dc3a6",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80c5ba0078e20d926d11d0778f9a43902664ebf0",
        "target": {
            "file": "include/net/netfilter/nf_conntrack_core.h"
        },
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "226855776401203361634937029285997249724",
                "227579407936046680165768259569119649041",
                "14400493576007805705873629621768379279",
                "109665851498028990586584556469471576037"
            ]
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Line"
    },
    {
        "id": "CVE-2023-53635-c8ff2ed4",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80c5ba0078e20d926d11d0778f9a43902664ebf0",
        "target": {
            "file": "net/netfilter/nf_conntrack_netlink.c",
            "function": "ctnetlink_dump_timeout"
        },
        "digest": {
            "function_hash": "277939547089348100937359961906261277857",
            "length": 277.0
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53635-cd9e380b",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@80c5ba0078e20d926d11d0778f9a43902664ebf0",
        "target": {
            "file": "include/net/netfilter/nf_conntrack_core.h",
            "function": "__nf_ct_set_timeout"
        },
        "digest": {
            "function_hash": "164951498392994704287571989190926872318",
            "length": 171.0
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53635-e08d9232",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f612ae1ab4793701caf39386fb3b7f4b3ef44e48",
        "target": {
            "file": "net/netfilter/nf_conntrack_netlink.c",
            "function": "ctnetlink_dump_timeout"
        },
        "digest": {
            "function_hash": "277939547089348100937359961906261277857",
            "length": 277.0
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53635-e784aec7",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@73db1b8f2bb6725b7391e85aab41fdf592b3c0c1",
        "target": {
            "file": "include/net/netfilter/nf_conntrack_core.h",
            "function": "__nf_ct_set_timeout"
        },
        "digest": {
            "function_hash": "164951498392994704287571989190926872318",
            "length": 171.0
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53635-e85ac922",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff5e4ac8dd7be7f1faba955c5779a68571eeb0f8",
        "target": {
            "file": "include/net/netfilter/nf_conntrack_core.h",
            "function": "__nf_ct_set_timeout"
        },
        "digest": {
            "function_hash": "164951498392994704287571989190926872318",
            "length": 171.0
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    },
    {
        "id": "CVE-2023-53635-feb924e2",
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff5e4ac8dd7be7f1faba955c5779a68571eeb0f8",
        "target": {
            "file": "net/netfilter/nf_conntrack_netlink.c",
            "function": "ctnetlink_dump_timeout"
        },
        "digest": {
            "function_hash": "277939547089348100937359961906261277857",
            "length": 277.0
        },
        "signature_version": "v1",
        "deprecated": false,
        "signature_type": "Function"
    }
]

Git / github.com/gregkh/linux