linux-cve-announce - CVE-2023-53549: netfilter: ipset: Rework long task execution when adding/deleting entries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025100446-CVE-2023-53549-9c74@gregkh>
Date: Sat,  4 Oct 2025 17:17:03 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53549: netfilter: ipset: Rework long task execution when adding/deleting entries

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: Rework long task execution when adding/deleting entries

When adding/deleting large number of elements in one step in ipset, it can
take a reasonable amount of time and can result in soft lockup errors. The
patch 5f7b51bf09ba ("netfilter: ipset: Limit the maximal range of
consecutive elements to add/delete") tried to fix it by limiting the max
elements to process at all. However it was not enough, it is still possible
that we get hung tasks. Lowering the limit is not reasonable, so the
approach in this patch is as follows: rely on the method used at resizing
sets and save the state when we reach a smaller internal batch limit,
unlock/lock and proceed from the saved state. Thus we can avoid long
continuous tasks and at the same time removed the limit to add/delete large
number of elements in one step.

The nfnl mutex is held during the whole operation which prevents one to
issue other ipset commands in parallel.

The Linux kernel CVE team has assigned CVE-2023-53549 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10.157 with commit e62e62ea912a49f7230620f1bdc20410b943a44c and fixed in 5.10.163 with commit ee756980e491c829ba0495bb420b7224a9ee26b2
	Issue introduced in 5.14 with commit 5f7b51bf09baca8e4f80cbe879536842bafb5f31 and fixed in 5.15.87 with commit a1e1521b463968b4eca7163f61fb6cc54d008061
	Issue introduced in 5.14 with commit 5f7b51bf09baca8e4f80cbe879536842bafb5f31 and fixed in 6.0.19 with commit 24a828f5a54bdeca0846526860d72b3766c5fe95
	Issue introduced in 5.14 with commit 5f7b51bf09baca8e4f80cbe879536842bafb5f31 and fixed in 6.1.5 with commit 8964cc36ba011dc0e1041131fa2e91fb4c2a811b
	Issue introduced in 5.14 with commit 5f7b51bf09baca8e4f80cbe879536842bafb5f31 and fixed in 6.2 with commit 5e29dc36bd5e2166b834ceb19990d9e68a734d7d
	Issue introduced in 5.13.14 with commit e0f824abe0f412f769fb5468b36c2471430bd885

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53549
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/linux/netfilter/ipset/ip_set.h
	net/netfilter/ipset/ip_set_core.c
	net/netfilter/ipset/ip_set_hash_ip.c
	net/netfilter/ipset/ip_set_hash_ipmark.c
	net/netfilter/ipset/ip_set_hash_ipport.c
	net/netfilter/ipset/ip_set_hash_ipportip.c
	net/netfilter/ipset/ip_set_hash_ipportnet.c
	net/netfilter/ipset/ip_set_hash_net.c
	net/netfilter/ipset/ip_set_hash_netiface.c
	net/netfilter/ipset/ip_set_hash_netnet.c
	net/netfilter/ipset/ip_set_hash_netport.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ee756980e491c829ba0495bb420b7224a9ee26b2
	https://git.kernel.org/stable/c/a1e1521b463968b4eca7163f61fb6cc54d008061
	https://git.kernel.org/stable/c/24a828f5a54bdeca0846526860d72b3766c5fe95
	https://git.kernel.org/stable/c/8964cc36ba011dc0e1041131fa2e91fb4c2a811b
	https://git.kernel.org/stable/c/5e29dc36bd5e2166b834ceb19990d9e68a734d7d