In the Linux kernel, the following vulnerability has been resolved:
net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
Currently in cdcncmchecktxmax(), if dwNtbOutMaxSize is lower than the calculated "min" value, but greater than zero, the logic sets txmax to dwNtbOutMaxSize. This is then used to allocate a new SKB in cdcncmfilltx_frame() where all the data is handled.
For small values of dwNtbOutMaxSize the memory allocated during allocskb(dwNtbOutMaxSize, GFPATOMIC) will have the same size, due to how size is aligned at alloc time: size = SKBDATAALIGN(size); size += SKBDATAALIGN(sizeof(struct skbsharedinfo)); Thus we hit the same bug that we tried to squash with commit 2be6d4d16a084 ("net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero")
Low values of dwNtbOutMaxSize do not cause an issue presently because at alloc_skb() time more memory (512b) is allocated than required for the SKB headers alone (320b), leaving some space (512b - 320b = 192b) for CDC data (172b).
However, if more elements (for example 3 x u64 = [24b]) were added to one of the SKB header structs, say 'struct skbsharedinfo', increasing its original size (320b [320b aligned]) to something larger (344b [384b aligned]), then suddenly the CDC data (172b) no longer fits in the spare SKB data area (512b - 384b = 128b).
Consequently the SKB bounds checking semantics fails and panics:
skbuff: skboverpanic: text:ffffffff831f755b len:184 put:172 head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 dev:<NULL> ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:113! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 57 Comm: kworker/0:2 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 Workqueue: mld mldifcwork RIP: 0010:skbpanic net/core/skbuff.c:113 [inline] RIP: 0010:skboverpanic+0x14c/0x150 net/core/skbuff.c:118 [snip] Call Trace: <TASK> skbput+0x151/0x210 net/core/skbuff.c:2047 skbputzero include/linux/skbuff.h:2422 [inline] cdcncmndp16 drivers/net/usb/cdcncm.c:1131 [inline] cdcncmfilltxframe+0x11ab/0x3da0 drivers/net/usb/cdcncm.c:1308 cdcncmtx_fixup+0xa3/0x100
Deal with too low values of dwNtbOutMaxSize, clamp it in the range [USBCDCNCMNTBMINOUTSIZE, CDCNCMNTBMAXSIZETX]. We ensure enough data space is allocated to handle CDC data by making sure dwNtbOutMaxSize is not smaller than USBCDCNCMNTBMINOUT_SIZE.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53667.json",
"cna_assigner": "Linux"
}[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf415bfe7573596ac213b4fd1da9e62cfc9a9413",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_fill_tx_frame"
},
"digest": {
"length": 5990.0,
"function_hash": "242409378271596841156114152400724278895"
},
"signature_version": "v1",
"id": "CVE-2023-53667-059dbd42"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff484163dfb61b58f23e4dbd007de1094427669c",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/net/usb/cdc_ncm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"233318598718330120968415725478591341427",
"47565547122524976934544495092819959138",
"53633539077496142239605181468381520326",
"90119741655274478263342365064978721804",
"268398335592827076463910318975480453757",
"202946407501929303707129880720866442015",
"264226342900166370631203547787538796749",
"169473540152882386521716839904744866714",
"45144794887251198645678172272755751827",
"23238011166988348034708570093824822101",
"79361659101350868117839937142168180760",
"23896876044958452145036681586772940994",
"8079347520052859490186717160877007574",
"58555007522950377554508465505661268919",
"44819034678120308192309137972461654627",
"61594408824946209907912766272397818500",
"146899196649396292436526188816935665963",
"152241374971217881325482774830365271735",
"201845681799282507653892755390670607137",
"145135750106122449810541806087611639444",
"150948529846798136962598333021133994489",
"255889936903214573713239034049611531648",
"200648222612439619328139232264536090578"
]
},
"signature_version": "v1",
"id": "CVE-2023-53667-0b13e08a"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72d0240b0ee4794efc683975c213e4b384fea733",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_check_tx_max"
},
"digest": {
"length": 696.0,
"function_hash": "225612026481895105594378779779838451734"
},
"signature_version": "v1",
"id": "CVE-2023-53667-18916143"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72d0240b0ee4794efc683975c213e4b384fea733",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/net/usb/cdc_ncm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"233318598718330120968415725478591341427",
"47565547122524976934544495092819959138",
"53633539077496142239605181468381520326",
"90119741655274478263342365064978721804",
"268398335592827076463910318975480453757",
"202946407501929303707129880720866442015",
"264226342900166370631203547787538796749",
"169473540152882386521716839904744866714",
"45144794887251198645678172272755751827",
"23238011166988348034708570093824822101",
"79361659101350868117839937142168180760",
"23896876044958452145036681586772940994",
"8079347520052859490186717160877007574",
"58555007522950377554508465505661268919",
"44819034678120308192309137972461654627",
"61594408824946209907912766272397818500",
"146899196649396292436526188816935665963",
"152241374971217881325482774830365271735",
"201845681799282507653892755390670607137",
"145135750106122449810541806087611639444",
"150948529846798136962598333021133994489",
"255889936903214573713239034049611531648",
"200648222612439619328139232264536090578"
]
},
"signature_version": "v1",
"id": "CVE-2023-53667-22dfad39"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9be921854e983a81a0aeeae5febcd87093086e46",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_check_tx_max"
},
"digest": {
"length": 696.0,
"function_hash": "225612026481895105594378779779838451734"
},
"signature_version": "v1",
"id": "CVE-2023-53667-39cb2c29"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e01c7f7046efc2c7c192c3619db43292b98e997",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/net/usb/cdc_ncm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"233318598718330120968415725478591341427",
"47565547122524976934544495092819959138",
"53633539077496142239605181468381520326",
"90119741655274478263342365064978721804",
"268398335592827076463910318975480453757",
"202946407501929303707129880720866442015",
"264226342900166370631203547787538796749",
"169473540152882386521716839904744866714",
"45144794887251198645678172272755751827",
"23238011166988348034708570093824822101",
"79361659101350868117839937142168180760",
"23896876044958452145036681586772940994",
"8079347520052859490186717160877007574",
"58555007522950377554508465505661268919",
"44819034678120308192309137972461654627",
"61594408824946209907912766272397818500",
"146899196649396292436526188816935665963",
"152241374971217881325482774830365271735",
"201845681799282507653892755390670607137",
"145135750106122449810541806087611639444",
"150948529846798136962598333021133994489",
"255889936903214573713239034049611531648",
"200648222612439619328139232264536090578"
]
},
"signature_version": "v1",
"id": "CVE-2023-53667-425e648c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@72d0240b0ee4794efc683975c213e4b384fea733",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_fill_tx_frame"
},
"digest": {
"length": 5990.0,
"function_hash": "242409378271596841156114152400724278895"
},
"signature_version": "v1",
"id": "CVE-2023-53667-6899889e"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42b78c8cc774b47023d6d16d96d54cc7015e4a07",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_fill_tx_frame"
},
"digest": {
"length": 5990.0,
"function_hash": "242409378271596841156114152400724278895"
},
"signature_version": "v1",
"id": "CVE-2023-53667-6d49aca5"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42b78c8cc774b47023d6d16d96d54cc7015e4a07",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/net/usb/cdc_ncm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"233318598718330120968415725478591341427",
"47565547122524976934544495092819959138",
"53633539077496142239605181468381520326",
"90119741655274478263342365064978721804",
"268398335592827076463910318975480453757",
"202946407501929303707129880720866442015",
"264226342900166370631203547787538796749",
"169473540152882386521716839904744866714",
"45144794887251198645678172272755751827",
"23238011166988348034708570093824822101",
"79361659101350868117839937142168180760",
"23896876044958452145036681586772940994",
"8079347520052859490186717160877007574",
"58555007522950377554508465505661268919",
"44819034678120308192309137972461654627",
"61594408824946209907912766272397818500",
"146899196649396292436526188816935665963",
"152241374971217881325482774830365271735",
"201845681799282507653892755390670607137",
"145135750106122449810541806087611639444",
"150948529846798136962598333021133994489",
"255889936903214573713239034049611531648",
"200648222612439619328139232264536090578"
]
},
"signature_version": "v1",
"id": "CVE-2023-53667-70fbbaf4"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6147745d43ff4e0d2c542e5b93e398ef0ee4db00",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_check_tx_max"
},
"digest": {
"length": 696.0,
"function_hash": "225612026481895105594378779779838451734"
},
"signature_version": "v1",
"id": "CVE-2023-53667-7a927248"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e01c7f7046efc2c7c192c3619db43292b98e997",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_check_tx_max"
},
"digest": {
"length": 696.0,
"function_hash": "225612026481895105594378779779838451734"
},
"signature_version": "v1",
"id": "CVE-2023-53667-848a2d34"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6147745d43ff4e0d2c542e5b93e398ef0ee4db00",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/net/usb/cdc_ncm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"233318598718330120968415725478591341427",
"47565547122524976934544495092819959138",
"53633539077496142239605181468381520326",
"90119741655274478263342365064978721804",
"268398335592827076463910318975480453757",
"202946407501929303707129880720866442015",
"264226342900166370631203547787538796749",
"169473540152882386521716839904744866714",
"45144794887251198645678172272755751827",
"23238011166988348034708570093824822101",
"79361659101350868117839937142168180760",
"23896876044958452145036681586772940994",
"8079347520052859490186717160877007574",
"58555007522950377554508465505661268919",
"44819034678120308192309137972461654627",
"61594408824946209907912766272397818500",
"146899196649396292436526188816935665963",
"152241374971217881325482774830365271735",
"201845681799282507653892755390670607137",
"145135750106122449810541806087611639444",
"150948529846798136962598333021133994489",
"255889936903214573713239034049611531648",
"200648222612439619328139232264536090578"
]
},
"signature_version": "v1",
"id": "CVE-2023-53667-9675529b"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2334ff0b343ba6ba7a6c0586fcc83992bbbc1776",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_fill_tx_frame"
},
"digest": {
"length": 5990.0,
"function_hash": "242409378271596841156114152400724278895"
},
"signature_version": "v1",
"id": "CVE-2023-53667-b216692f"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2334ff0b343ba6ba7a6c0586fcc83992bbbc1776",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_check_tx_max"
},
"digest": {
"length": 696.0,
"function_hash": "225612026481895105594378779779838451734"
},
"signature_version": "v1",
"id": "CVE-2023-53667-b60d9de9"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf415bfe7573596ac213b4fd1da9e62cfc9a9413",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/net/usb/cdc_ncm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"233318598718330120968415725478591341427",
"47565547122524976934544495092819959138",
"53633539077496142239605181468381520326",
"90119741655274478263342365064978721804",
"268398335592827076463910318975480453757",
"202946407501929303707129880720866442015",
"264226342900166370631203547787538796749",
"169473540152882386521716839904744866714",
"45144794887251198645678172272755751827",
"23238011166988348034708570093824822101",
"79361659101350868117839937142168180760",
"23896876044958452145036681586772940994",
"8079347520052859490186717160877007574",
"58555007522950377554508465505661268919",
"44819034678120308192309137972461654627",
"61594408824946209907912766272397818500",
"146899196649396292436526188816935665963",
"152241374971217881325482774830365271735",
"201845681799282507653892755390670607137",
"145135750106122449810541806087611639444",
"150948529846798136962598333021133994489",
"255889936903214573713239034049611531648",
"200648222612439619328139232264536090578"
]
},
"signature_version": "v1",
"id": "CVE-2023-53667-bc7c9f05"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9be921854e983a81a0aeeae5febcd87093086e46",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_fill_tx_frame"
},
"digest": {
"length": 5990.0,
"function_hash": "242409378271596841156114152400724278895"
},
"signature_version": "v1",
"id": "CVE-2023-53667-bdf2a672"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9be921854e983a81a0aeeae5febcd87093086e46",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/net/usb/cdc_ncm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"233318598718330120968415725478591341427",
"47565547122524976934544495092819959138",
"53633539077496142239605181468381520326",
"90119741655274478263342365064978721804",
"268398335592827076463910318975480453757",
"202946407501929303707129880720866442015",
"264226342900166370631203547787538796749",
"169473540152882386521716839904744866714",
"45144794887251198645678172272755751827",
"23238011166988348034708570093824822101",
"79361659101350868117839937142168180760",
"23896876044958452145036681586772940994",
"8079347520052859490186717160877007574",
"58555007522950377554508465505661268919",
"44819034678120308192309137972461654627",
"61594408824946209907912766272397818500",
"146899196649396292436526188816935665963",
"152241374971217881325482774830365271735",
"201845681799282507653892755390670607137",
"145135750106122449810541806087611639444",
"150948529846798136962598333021133994489",
"255889936903214573713239034049611531648",
"200648222612439619328139232264536090578"
]
},
"signature_version": "v1",
"id": "CVE-2023-53667-bf53b57c"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42b78c8cc774b47023d6d16d96d54cc7015e4a07",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_check_tx_max"
},
"digest": {
"length": 696.0,
"function_hash": "225612026481895105594378779779838451734"
},
"signature_version": "v1",
"id": "CVE-2023-53667-c1d971d8"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff484163dfb61b58f23e4dbd007de1094427669c",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_fill_tx_frame"
},
"digest": {
"length": 5990.0,
"function_hash": "242409378271596841156114152400724278895"
},
"signature_version": "v1",
"id": "CVE-2023-53667-c3465ea3"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6147745d43ff4e0d2c542e5b93e398ef0ee4db00",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_fill_tx_frame"
},
"digest": {
"length": 5990.0,
"function_hash": "242409378271596841156114152400724278895"
},
"signature_version": "v1",
"id": "CVE-2023-53667-d09ad05e"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf415bfe7573596ac213b4fd1da9e62cfc9a9413",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_check_tx_max"
},
"digest": {
"length": 696.0,
"function_hash": "225612026481895105594378779779838451734"
},
"signature_version": "v1",
"id": "CVE-2023-53667-daac51b9"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ff484163dfb61b58f23e4dbd007de1094427669c",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_check_tx_max"
},
"digest": {
"length": 696.0,
"function_hash": "225612026481895105594378779779838451734"
},
"signature_version": "v1",
"id": "CVE-2023-53667-e51fa4af"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2334ff0b343ba6ba7a6c0586fcc83992bbbc1776",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/net/usb/cdc_ncm.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"233318598718330120968415725478591341427",
"47565547122524976934544495092819959138",
"53633539077496142239605181468381520326",
"90119741655274478263342365064978721804",
"268398335592827076463910318975480453757",
"202946407501929303707129880720866442015",
"264226342900166370631203547787538796749",
"169473540152882386521716839904744866714",
"45144794887251198645678172272755751827",
"23238011166988348034708570093824822101",
"79361659101350868117839937142168180760",
"23896876044958452145036681586772940994",
"8079347520052859490186717160877007574",
"58555007522950377554508465505661268919",
"44819034678120308192309137972461654627",
"61594408824946209907912766272397818500",
"146899196649396292436526188816935665963",
"152241374971217881325482774830365271735",
"201845681799282507653892755390670607137",
"145135750106122449810541806087611639444",
"150948529846798136962598333021133994489",
"255889936903214573713239034049611531648",
"200648222612439619328139232264536090578"
]
},
"signature_version": "v1",
"id": "CVE-2023-53667-eeeecb93"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e01c7f7046efc2c7c192c3619db43292b98e997",
"deprecated": false,
"signature_type": "Function",
"target": {
"file": "drivers/net/usb/cdc_ncm.c",
"function": "cdc_ncm_fill_tx_frame"
},
"digest": {
"length": 5990.0,
"function_hash": "242409378271596841156114152400724278895"
},
"signature_version": "v1",
"id": "CVE-2023-53667-fa434dd1"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53667.json"