linux-cve-announce - CVE-2023-53338: lwt: Fix return values of BPF xmit ops

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025091718-CVE-2023-53338-8224@gregkh>
Date: Wed, 17 Sep 2025 16:56:37 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53338: lwt: Fix return values of BPF xmit ops

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

lwt: Fix return values of BPF xmit ops

BPF encap ops can return different types of positive values, such like
NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function
skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return
values would be treated implicitly as LWTUNNEL_XMIT_CONTINUE in
ip(6)_finish_output2. When this happens, skbs that have been freed would
continue to the neighbor subsystem, causing use-after-free bug and
kernel crashes.

To fix the incorrect behavior, skb_do_redirect return values can be
simply discarded, the same as tc-egress behavior. On the other hand,
bpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU
information. Thus convert its return values to avoid the conflict with
LWTUNNEL_XMIT_CONTINUE.

The Linux kernel CVE team has assigned CVE-2023-53338 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.10 with commit 3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 and fixed in 5.4.257 with commit 67f8f2bae8e7ac72e09def2b667e44704c4d1ee1
	Issue introduced in 4.10 with commit 3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 and fixed in 5.10.195 with commit a97f221651fcdc891166e9bc270e3d9bfa5a0080
	Issue introduced in 4.10 with commit 3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 and fixed in 5.15.132 with commit e3f647e4b642f9f6d32795a16f92c116c138d2af
	Issue introduced in 4.10 with commit 3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 and fixed in 6.1.53 with commit 065d5f17096ec9161180e2c890afdff4dc6125f2
	Issue introduced in 4.10 with commit 3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 and fixed in 6.4.16 with commit d68c17402442f5f494a2c3ebde5cb82f6aa9160a
	Issue introduced in 4.10 with commit 3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 and fixed in 6.5.3 with commit 65583f9e070db7bece20710cfa2e3daeb0b831d9
	Issue introduced in 4.10 with commit 3a0af8fd61f90920f6fa04e4f1e9a6a73c1b4fd2 and fixed in 6.6 with commit 29b22badb7a84b783e3a4fffca16f7768fb31205

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53338
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/core/lwt_bpf.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/67f8f2bae8e7ac72e09def2b667e44704c4d1ee1
	https://git.kernel.org/stable/c/a97f221651fcdc891166e9bc270e3d9bfa5a0080
	https://git.kernel.org/stable/c/e3f647e4b642f9f6d32795a16f92c116c138d2af
	https://git.kernel.org/stable/c/065d5f17096ec9161180e2c890afdff4dc6125f2
	https://git.kernel.org/stable/c/d68c17402442f5f494a2c3ebde5cb82f6aa9160a
	https://git.kernel.org/stable/c/65583f9e070db7bece20710cfa2e3daeb0b831d9
	https://git.kernel.org/stable/c/29b22badb7a84b783e3a4fffca16f7768fb31205