Message-ID: <2025100704-CVE-2023-53667-9b2e@gregkh>
Date: Tue,  7 Oct 2025 17:21:26 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53667: net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize

Currently in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is lower than
the calculated "min" value, but greater than zero, the logic sets
tx_max to dwNtbOutMaxSize. This is then used to allocate a new SKB in
cdc_ncm_fill_tx_frame() where all the data is handled.

For small values of dwNtbOutMaxSize the memory allocated during
alloc_skb(dwNtbOutMaxSize, GFP_ATOMIC) will have the same size, due to
how size is aligned at alloc time:
	size = SKB_DATA_ALIGN(size);
        size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
Thus we hit the same bug that we tried to squash with
commit 2be6d4d16a084 ("net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero")

Low values of dwNtbOutMaxSize do not cause an issue presently because at
alloc_skb() time more memory (512b) is allocated than required for the
SKB headers alone (320b), leaving some space (512b - 320b = 192b)
for CDC data (172b).

However, if more elements (for example 3 x u64 = [24b]) were added to
one of the SKB header structs, say 'struct skb_shared_info',
increasing its original size (320b [320b aligned]) to something larger
(344b [384b aligned]), then suddenly the CDC data (172b) no longer
fits in the spare SKB data area (512b - 384b = 128b).

Consequently the SKB bounds checking semantics fails and panics:

skbuff: skb_over_panic: text:ffffffff831f755b len:184 put:172 head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:113!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 57 Comm: kworker/0:2 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: mld mld_ifc_work
RIP: 0010:skb_panic net/core/skbuff.c:113 [inline]
RIP: 0010:skb_over_panic+0x14c/0x150 net/core/skbuff.c:118
[snip]
Call Trace:
 <TASK>
 skb_put+0x151/0x210 net/core/skbuff.c:2047
 skb_put_zero include/linux/skbuff.h:2422 [inline]
 cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1131 [inline]
 cdc_ncm_fill_tx_frame+0x11ab/0x3da0 drivers/net/usb/cdc_ncm.c:1308
 cdc_ncm_tx_fixup+0xa3/0x100

Deal with too low values of dwNtbOutMaxSize, clamp it in the range
[USB_CDC_NCM_NTB_MIN_OUT_SIZE, CDC_NCM_NTB_MAX_SIZE_TX]. We ensure
enough data space is allocated to handle CDC data by making sure
dwNtbOutMaxSize is not smaller than USB_CDC_NCM_NTB_MIN_OUT_SIZE.

The Linux kernel CVE team has assigned CVE-2023-53667 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.16 with commit 289507d3364f96f4b8814726917d572f71350d87 and fixed in 4.14.317 with commit 2334ff0b343ba6ba7a6c0586fcc83992bbbc1776
	Issue introduced in 3.16 with commit 289507d3364f96f4b8814726917d572f71350d87 and fixed in 4.19.285 with commit bf415bfe7573596ac213b4fd1da9e62cfc9a9413
	Issue introduced in 3.16 with commit 289507d3364f96f4b8814726917d572f71350d87 and fixed in 5.4.245 with commit ff484163dfb61b58f23e4dbd007de1094427669c
	Issue introduced in 3.16 with commit 289507d3364f96f4b8814726917d572f71350d87 and fixed in 5.10.181 with commit 42b78c8cc774b47023d6d16d96d54cc7015e4a07
	Issue introduced in 3.16 with commit 289507d3364f96f4b8814726917d572f71350d87 and fixed in 5.15.114 with commit 9be921854e983a81a0aeeae5febcd87093086e46
	Issue introduced in 3.16 with commit 289507d3364f96f4b8814726917d572f71350d87 and fixed in 6.1.31 with commit 6147745d43ff4e0d2c542e5b93e398ef0ee4db00
	Issue introduced in 3.16 with commit 289507d3364f96f4b8814726917d572f71350d87 and fixed in 6.3.5 with commit 72d0240b0ee4794efc683975c213e4b384fea733
	Issue introduced in 3.16 with commit 289507d3364f96f4b8814726917d572f71350d87 and fixed in 6.4 with commit 7e01c7f7046efc2c7c192c3619db43292b98e997

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53667
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/usb/cdc_ncm.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/2334ff0b343ba6ba7a6c0586fcc83992bbbc1776
	https://git.kernel.org/stable/c/bf415bfe7573596ac213b4fd1da9e62cfc9a9413
	https://git.kernel.org/stable/c/ff484163dfb61b58f23e4dbd007de1094427669c
	https://git.kernel.org/stable/c/42b78c8cc774b47023d6d16d96d54cc7015e4a07
	https://git.kernel.org/stable/c/9be921854e983a81a0aeeae5febcd87093086e46
	https://git.kernel.org/stable/c/6147745d43ff4e0d2c542e5b93e398ef0ee4db00
	https://git.kernel.org/stable/c/72d0240b0ee4794efc683975c213e4b384fea733
	https://git.kernel.org/stable/c/7e01c7f7046efc2c7c192c3619db43292b98e997

Powered by blists - more mailing lists