| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024030251-CVE-2023-52513-5224@gregkh> Date: Sat, 2 Mar 2024 22:52:58 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2023-52513: RDMA/siw: Fix connection failure handling Description =========== In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix connection failure handling In case immediate MPA request processing fails, the newly created endpoint unlinks the listening endpoint and is ready to be dropped. This special case was not handled correctly by the code handling the later TCP socket close, causing a NULL dereference crash in siw_cm_work_handler() when dereferencing a NULL listener. We now also cancel the useless MPA timeout, if immediate MPA request processing fails. This patch furthermore simplifies MPA processing in general: Scheduling a useless TCP socket read in sk_data_ready() upcall is now surpressed, if the socket is already moved out of TCP_ESTABLISHED state. The Linux kernel CVE team has assigned CVE-2023-52513 to this issue. Affected and fixed versions =========================== Issue introduced in 5.3 with commit 6c52fdc244b5 and fixed in 5.4.258 with commit 6e26812e289b Issue introduced in 5.3 with commit 6c52fdc244b5 and fixed in 5.10.198 with commit 0d520cdb0cd0 Issue introduced in 5.3 with commit 6c52fdc244b5 and fixed in 5.15.135 with commit 81b7bf367eea Issue introduced in 5.3 with commit 6c52fdc244b5 and fixed in 6.1.57 with commit 5cf38e638e5d Issue introduced in 5.3 with commit 6c52fdc244b5 and fixed in 6.5.7 with commit eeafc50a77f6 Issue introduced in 5.3 with commit 6c52fdc244b5 and fixed in 6.6 with commit 53a3f7770497 Please see https://www.kernel.org or a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-52513 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/infiniband/sw/siw/siw_cm.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/6e26812e289b374c17677d238164a5a8f5770594 https://git.kernel.org/stable/c/0d520cdb0cd095eac5d00078dfd318408c9b5eed https://git.kernel.org/stable/c/81b7bf367eea795d259d0261710c6a89f548844d https://git.kernel.org/stable/c/5cf38e638e5d01b68f9133968a85e8b3fd1ecf2f https://git.kernel.org/stable/c/eeafc50a77f6a783c2c44e7ec3674a7b693e06f8 https://git.kernel.org/stable/c/53a3f777049771496f791504e7dc8ef017cba590
Powered by blists - more mailing lists