| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025091557-CVE-2023-53189-19c2@gregkh> Date: Mon, 15 Sep 2025 16:02:43 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2023-53189: ipv6/addrconf: fix a potential refcount underflow for idev From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer(), reference idev depends on whether rs_timer is not pending. Then modify rs_timer timeout. There is a time gap in [1], during which if the pending rs_timer becomes not pending. It will miss to hold idev, but the rs_timer is activated. Thus rs_timer callback function addrconf_rs_timer() will be executed and put idev later without holding idev. A refcount underflow issue for idev can be caused by this. if (!timer_pending(&idev->rs_timer)) in6_dev_hold(idev); <--------------[1] mod_timer(&idev->rs_timer, jiffies + when); To fix the issue, hold idev if mod_timer() return 0. The Linux kernel CVE team has assigned CVE-2023-53189 to this issue. Affected and fixed versions =========================== Issue introduced in 3.11 with commit b7b1bfce0bb68bd8f6e62a28295922785cc63781 and fixed in 4.14.322 with commit c6395e32935d35e6f935e7caf1c2dac5a95943b4 Issue introduced in 3.11 with commit b7b1bfce0bb68bd8f6e62a28295922785cc63781 and fixed in 4.19.291 with commit df62fdcd004afa72ecbed0e862ebb983acd3aa57 Issue introduced in 3.11 with commit b7b1bfce0bb68bd8f6e62a28295922785cc63781 and fixed in 5.4.251 with commit c7eeba47058532f6077d6a658e38b6698f6ae71a Issue introduced in 3.11 with commit b7b1bfce0bb68bd8f6e62a28295922785cc63781 and fixed in 5.10.188 with commit 2ad31ce40e8182860b631e37209e93e543790b7c Issue introduced in 3.11 with commit b7b1bfce0bb68bd8f6e62a28295922785cc63781 and fixed in 5.15.121 with commit 82abd1c37d3bf2a2658b34772c17a25a6f9cca42 Issue introduced in 3.11 with commit b7b1bfce0bb68bd8f6e62a28295922785cc63781 and fixed in 6.1.40 with commit 436b7cc7eae7851c184b671ed7a4a64c750b86f7 Issue introduced in 3.11 with commit b7b1bfce0bb68bd8f6e62a28295922785cc63781 and fixed in 6.4.5 with commit 1f656e483eb4733d62f18dfb206a49b78f60f495 Issue introduced in 3.11 with commit b7b1bfce0bb68bd8f6e62a28295922785cc63781 and fixed in 6.5 with commit 06a0716949c22e2aefb648526580671197151acc Issue introduced in 3.10.105 with commit 973d5956f754cfc306f5e274d71503498f4b0324 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-53189 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/ipv6/addrconf.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c6395e32935d35e6f935e7caf1c2dac5a95943b4 https://git.kernel.org/stable/c/df62fdcd004afa72ecbed0e862ebb983acd3aa57 https://git.kernel.org/stable/c/c7eeba47058532f6077d6a658e38b6698f6ae71a https://git.kernel.org/stable/c/2ad31ce40e8182860b631e37209e93e543790b7c https://git.kernel.org/stable/c/82abd1c37d3bf2a2658b34772c17a25a6f9cca42 https://git.kernel.org/stable/c/436b7cc7eae7851c184b671ed7a4a64c750b86f7 https://git.kernel.org/stable/c/1f656e483eb4733d62f18dfb206a49b78f60f495 https://git.kernel.org/stable/c/06a0716949c22e2aefb648526580671197151acc
Powered by blists - more mailing lists