linux-cve-announce - CVE-2023-53053: erspan: do not use skb_mac_header() in ndo_start

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2025050207-CVE-2023-53053-bb9d@gregkh>
Date: Fri,  2 May 2025 17:55:18 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53053: erspan: do not use skb_mac_header() in ndo_start_xmit()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

erspan: do not use skb_mac_header() in ndo_start_xmit()

Drivers should not assume skb_mac_header(skb) == skb->data in their
ndo_start_xmit().

Use skb_network_offset() and skb_transport_offset() which
better describe what is needed in erspan_fb_xmit() and
ip6erspan_tunnel_xmit()

syzbot reported:
WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 skb_mac_header include/linux/skbuff.h:2873 [inline]
WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962
Modules linked in:
CPU: 0 PID: 5083 Comm: syz-executor406 Not tainted 6.3.0-rc2-syzkaller-00866-gd4671cb96fa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
RIP: 0010:skb_mac_header include/linux/skbuff.h:2873 [inline]
RIP: 0010:ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962
Code: 04 02 41 01 de 84 c0 74 08 3c 03 0f 8e 1c 0a 00 00 45 89 b4 24 c8 00 00 00 c6 85 77 fe ff ff 01 e9 33 e7 ff ff e8 b4 27 a1 f8 <0f> 0b e9 b6 e7 ff ff e8 a8 27 a1 f8 49 8d bf f0 0c 00 00 48 b8 00
RSP: 0018:ffffc90003b2f830 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000
RDX: ffff888021273a80 RSI: ffffffff88e1bd4c RDI: 0000000000000003
RBP: ffffc90003b2f9d8 R08: 0000000000000003 R09: 000000000000ffff
R10: 000000000000ffff R11: 0000000000000000 R12: ffff88802b28da00
R13: 00000000000000d0 R14: ffff88807e25b6d0 R15: ffff888023408000
FS: 0000555556a61300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055e5b11eb6e8 CR3: 0000000027c1b000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__netdev_start_xmit include/linux/netdevice.h:4900 [inline]
netdev_start_xmit include/linux/netdevice.h:4914 [inline]
__dev_direct_xmit+0x504/0x730 net/core/dev.c:4300
dev_direct_xmit include/linux/netdevice.h:3088 [inline]
packet_xmit+0x20a/0x390 net/packet/af_packet.c:285
packet_snd net/packet/af_packet.c:3075 [inline]
packet_sendmsg+0x31a0/0x5150 net/packet/af_packet.c:3107
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0xde/0x190 net/socket.c:747
__sys_sendto+0x23a/0x340 net/socket.c:2142
__do_sys_sendto net/socket.c:2154 [inline]
__se_sys_sendto net/socket.c:2150 [inline]
__x64_sys_sendto+0xe1/0x1b0 net/socket.c:2150
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f123aaa1039
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc15d12058 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f123aaa1039
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000020000040 R09: 0000000000000014
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f123aa648c0
R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000

The Linux kernel CVE team has assigned CVE-2023-53053 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.18 with commit 1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2 and fixed in 4.19.280 with commit da149daf821a3c05cd04f7c60776c86c5ee9685c
	Issue introduced in 4.18 with commit 1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2 and fixed in 5.4.240 with commit b72f453e886af532bde1fd049a2d2421999630d3
	Issue introduced in 4.18 with commit 1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2 and fixed in 5.10.177 with commit f8cec30541f5c5cc218e9a32138d45d227727f2f
	Issue introduced in 4.18 with commit 1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2 and fixed in 5.15.105 with commit b41f37dbd9cdb60000e3b0dfad6df787591c2265
	Issue introduced in 4.18 with commit 1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2 and fixed in 6.1.22 with commit 9c7d6803689c99d55bbb862260d0ba486ff23c0b
	Issue introduced in 4.18 with commit 1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2 and fixed in 6.2.9 with commit 5d4172732f0ee1639a361a6cc5c3114bbb397386
	Issue introduced in 4.18 with commit 1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2 and fixed in 6.3 with commit 8e50ed774554f93d55426039b27b1e38d7fa64d8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53053
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/ip_gre.c
	net/ipv6/ip6_gre.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/da149daf821a3c05cd04f7c60776c86c5ee9685c
	https://git.kernel.org/stable/c/b72f453e886af532bde1fd049a2d2421999630d3
	https://git.kernel.org/stable/c/f8cec30541f5c5cc218e9a32138d45d227727f2f
	https://git.kernel.org/stable/c/b41f37dbd9cdb60000e3b0dfad6df787591c2265
	https://git.kernel.org/stable/c/9c7d6803689c99d55bbb862260d0ba486ff23c0b
	https://git.kernel.org/stable/c/5d4172732f0ee1639a361a6cc5c3114bbb397386
	https://git.kernel.org/stable/c/8e50ed774554f93d55426039b27b1e38d7fa64d8