linux-cve-announce - CVE-2023-54238: mlx5: fix skb leak while fifo resync and push

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025123033-CVE-2023-54238-87c9@gregkh>
Date: Tue, 30 Dec 2025 13:14:08 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-54238: mlx5: fix skb leak while fifo resync and push

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mlx5: fix skb leak while fifo resync and push

During ptp resync operation SKBs were poped from the fifo but were never
freed neither by napi_consume nor by dev_kfree_skb_any. Add call to
napi_consume_skb to properly free SKBs.

Another leak was happening because mlx5e_skb_fifo_has_room() had an error
in the check. Comparing free running counters works well unless C promotes
the types to something wider than the counter. In this case counters are
u16 but the result of the substraction is promouted to int and it causes
wrong result (negative value) of the check when producer have already
overlapped but consumer haven't yet. Explicit cast to u16 fixes the issue.

The Linux kernel CVE team has assigned CVE-2023-54238 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.0 with commit 58a518948f60153e8f6cb8361d2712aa3a1af94a and fixed in 6.1.18 with commit 234cffda95e1049f58e8ec136ef105c633f0ed19
	Issue introduced in 6.0 with commit 58a518948f60153e8f6cb8361d2712aa3a1af94a and fixed in 6.2.5 with commit 68504c66d08c70fb92799722e25a932d311d74fd
	Issue introduced in 6.0 with commit 58a518948f60153e8f6cb8361d2712aa3a1af94a and fixed in 6.3 with commit e435941b1da1a0be4ff8a7ae425774c76a5ac514

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-54238
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
	drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/234cffda95e1049f58e8ec136ef105c633f0ed19
	https://git.kernel.org/stable/c/68504c66d08c70fb92799722e25a932d311d74fd
	https://git.kernel.org/stable/c/e435941b1da1a0be4ff8a7ae425774c76a5ac514