linux-cve-announce - CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025100449-CVE-2023-53559-c2f0@gregkh>
Date: Sat,  4 Oct 2025 17:17:13 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53559: ip_vti: fix potential slab-use-after-free in decode_session6

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ip_vti: fix potential slab-use-after-free in decode_session6

When ip_vti device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when ip_vti device sends IPv6 packets.
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.

The Linux kernel CVE team has assigned CVE-2023-53559 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.19 with commit f855691975bb06373a98711e4cfe2c224244b536 and fixed in 4.14.324 with commit 82fb41c5de243e7dfa90f32ca58e35adaff56c1d
	Issue introduced in 3.19 with commit f855691975bb06373a98711e4cfe2c224244b536 and fixed in 4.19.293 with commit 7dfe23659f3677c08a60a0056cda2d91a79c15ca
	Issue introduced in 3.19 with commit f855691975bb06373a98711e4cfe2c224244b536 and fixed in 5.4.255 with commit d34c30442d5e53a33cde79ca163320dbe2432cbd
	Issue introduced in 3.19 with commit f855691975bb06373a98711e4cfe2c224244b536 and fixed in 5.10.192 with commit 0b4d69539fdea138af2befe08893850c89248068
	Issue introduced in 3.19 with commit f855691975bb06373a98711e4cfe2c224244b536 and fixed in 5.15.128 with commit e1e04cc2ef2c0c0866c19f5627149a76c2baae32
	Issue introduced in 3.19 with commit f855691975bb06373a98711e4cfe2c224244b536 and fixed in 6.1.47 with commit 2b05bf5dc437f7891dd409a3eaf5058459391c7a
	Issue introduced in 3.19 with commit f855691975bb06373a98711e4cfe2c224244b536 and fixed in 6.4.12 with commit 78e397a43e1c47321a4679cc49a6c4530bf820b9
	Issue introduced in 3.19 with commit f855691975bb06373a98711e4cfe2c224244b536 and fixed in 6.5 with commit 6018a266279b1a75143c7c0804dd08a5fc4c3e0b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53559
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/ip_vti.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/82fb41c5de243e7dfa90f32ca58e35adaff56c1d
	https://git.kernel.org/stable/c/7dfe23659f3677c08a60a0056cda2d91a79c15ca
	https://git.kernel.org/stable/c/d34c30442d5e53a33cde79ca163320dbe2432cbd
	https://git.kernel.org/stable/c/0b4d69539fdea138af2befe08893850c89248068
	https://git.kernel.org/stable/c/e1e04cc2ef2c0c0866c19f5627149a76c2baae32
	https://git.kernel.org/stable/c/2b05bf5dc437f7891dd409a3eaf5058459391c7a
	https://git.kernel.org/stable/c/78e397a43e1c47321a4679cc49a6c4530bf820b9
	https://git.kernel.org/stable/c/6018a266279b1a75143c7c0804dd08a5fc4c3e0b