CVE-2023-52881

一、漏洞信息
 漏洞编号：[CVE-2023-52881](https://nvd.nist.gov/vuln/detail/CVE-2023-52881)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.1.8,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:tcp: do not accept ACK of bytes we never sentThis patch is based on a detailed report and ideas from Yepeng Panand Christian Rossow.ACK seq validation is currently following RFC 5961 5.2 guidelines:   The ACK value is considered acceptable only if   it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <=   SND.NXT).  All incoming segments whose ACK value doesn t satisfy the   above condition MUST be discarded and an ACK sent back.  It needs to   be noted that RFC 793 on page 72 (fifth check) says:  If the ACK is a   duplicate (SEG.ACK < SND.UNA), it can be ignored.  If the ACK   acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an   ACK, drop the segment, and return .  The  ignored  above implies that   the processing of the incoming data segment continues, which means   the ACK value is treated as acceptable.  This mitigation makes the   ACK check more stringent since any ACK < SND.UNA wouldn t be   accepted, instead only ACKs that are in the range ((SND.UNA -   MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through.This can be refined for new (and possibly spoofed) flows,by not accepting ACK for bytes that were never sent.This greatly improves TCP security at a little cost.I added a Fixes: tag to make sure this patch will reach stable trees,even if the  blamed  patch was adhering to the RFC.tp->bytes_acked was added in linux-4.2Following packetdrill test (courtesy of Yepeng Pan) showsthe issue at hand:0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0+0 bind(3, ..., ...) = 0+0 listen(3, 1024) = 0// ---------------- Handshake ------------------- //// when window scale is set to 14 the window size can be extended to// 65535 * (2^14) = 1073725440. Linux would accept an ACK packet// with ack number in (Server_ISN+1-1073725440. Server_ISN+1)// ,though this ack number acknowledges some data never// sent by the server.+0 < S 0:0(0) win 65535 <mss 1400,nop,wscale 14>+0 > S. 0:0(0) ack 1 <...>+0 < . 1:1(0) ack 1 win 65535+0 accept(3, ..., ...) = 4// For the established connection, we send an ACK packet,// the ack packet uses ack number 1 - 1073725300 + 2^32,// where 2^32 is used to wrap around.// Note: we used 1073725300 instead of 1073725440 to avoid possible// edge cases.// 1 - 1073725300 + 2^32 = 3221241997// Oops, old kernels happily accept this packet.+0 < . 1:1001(1000) ack 3221241997 win 65535// After the kernel fix the following will be replaced by a challenge ACK,// and prior malicious frame would be dropped.+0 > . 1:1(0) ack 1001
 漏洞公开时间：2024-05-29 19:16:02
 漏洞创建时间：2024-05-29 11:48:46
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-52881
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/008b807fe487e0b15a3a6c39add4eb477f73e440 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/0d4e0afdd6658cd21dd5be61880411a2553fd1fc |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/2087d53a66e97a5eb5d1bf558d5bef9e5f891757 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/458f07ffeccd17f99942311e09ef574ddf4a414a |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/69eae75ca5255e876628ac5cee9eaab31f644b57 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/7ffff0cc929fdfc62a74b384c4903d6496c910f0 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/b17a886ed29f3b70b78ccf632dad03e0c69e3c1a |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-52881 | https://bugzilla.suse.com/show_bug.cgi?id=1225611 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-52881 | https://bugzilla.suse.com/show_bug.cgi?id=1225611 |
| suse_bugzilla | https://git.kernel.org/stable/c/008b807fe487e0b15a3a6c39add4eb477f73e440 | https://bugzilla.suse.com/show_bug.cgi?id=1225611 |
| suse_bugzilla | https://git.kernel.org/stable/c/0d4e0afdd6658cd21dd5be61880411a2553fd1fc | https://bugzilla.suse.com/show_bug.cgi?id=1225611 |
| suse_bugzilla | https://git.kernel.org/stable/c/2087d53a66e97a5eb5d1bf558d5bef9e5f891757 | https://bugzilla.suse.com/show_bug.cgi?id=1225611 |
| suse_bugzilla | https://git.kernel.org/stable/c/3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 | https://bugzilla.suse.com/show_bug.cgi?id=1225611 |
| suse_bugzilla | https://git.kernel.org/stable/c/458f07ffeccd17f99942311e09ef574ddf4a414a | https://bugzilla.suse.com/show_bug.cgi?id=1225611 |
| suse_bugzilla | https://git.kernel.org/stable/c/69eae75ca5255e876628ac5cee9eaab31f644b57 | https://bugzilla.suse.com/show_bug.cgi?id=1225611 |
| suse_bugzilla | https://git.kernel.org/stable/c/7ffff0cc929fdfc62a74b384c4903d6496c910f0 | https://bugzilla.suse.com/show_bug.cgi?id=1225611 |
| suse_bugzilla | https://git.kernel.org/stable/c/b17a886ed29f3b70b78ccf632dad03e0c69e3c1a | https://bugzilla.suse.com/show_bug.cgi?id=1225611 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2023/CVE-2023-52881.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1225611 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4211 | https://bugzilla.redhat.com/show_bug.cgi?id=2258875 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:4352 | https://bugzilla.redhat.com/show_bug.cgi?id=2258875 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:5281 | https://bugzilla.redhat.com/show_bug.cgi?id=2258875 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:6206 | https://bugzilla.redhat.com/show_bug.cgi?id=2258875 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:10773 | https://bugzilla.redhat.com/show_bug.cgi?id=2258875 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2024:10772 | https://bugzilla.redhat.com/show_bug.cgi?id=2258875 |
| ubuntu | https://www.cve.org/CVERecord?id=CVE-2023-52881 | https://ubuntu.com/security/CVE-2023-52881 |
| ubuntu | https://git.kernel.org/linus/3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 (6.7-rc5) | https://ubuntu.com/security/CVE-2023-52881 |
| ubuntu | https://git.kernel.org/stable/c/69eae75ca5255e876628ac5cee9eaab31f644b57 | https://ubuntu.com/security/CVE-2023-52881 |
| ubuntu | https://git.kernel.org/stable/c/458f07ffeccd17f99942311e09ef574ddf4a414a | https://ubuntu.com/security/CVE-2023-52881 |
| ubuntu | https://git.kernel.org/stable/c/7ffff0cc929fdfc62a74b384c4903d6496c910f0 | https://ubuntu.com/security/CVE-2023-52881 |
| ubuntu | https://git.kernel.org/stable/c/b17a886ed29f3b70b78ccf632dad03e0c69e3c1a | https://ubuntu.com/security/CVE-2023-52881 |
| ubuntu | https://git.kernel.org/stable/c/0d4e0afdd6658cd21dd5be61880411a2553fd1fc | https://ubuntu.com/security/CVE-2023-52881 |
| ubuntu | https://git.kernel.org/stable/c/008b807fe487e0b15a3a6c39add4eb477f73e440 | https://ubuntu.com/security/CVE-2023-52881 |
| ubuntu | https://git.kernel.org/stable/c/2087d53a66e97a5eb5d1bf558d5bef9e5f891757 | https://ubuntu.com/security/CVE-2023-52881 |
| ubuntu | https://git.kernel.org/stable/c/3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 | https://ubuntu.com/security/CVE-2023-52881 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2023-52881 | https://ubuntu.com/security/CVE-2023-52881 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2023-52881 | https://ubuntu.com/security/CVE-2023-52881 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2023-52881 | https://ubuntu.com/security/CVE-2023-52881 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-52881 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2023-52881 |
| cve_search |  | https://git.kernel.org/stable/c/69eae75ca5255e876628ac5cee9eaab31f644b57 |
| cve_search |  | https://git.kernel.org/stable/c/458f07ffeccd17f99942311e09ef574ddf4a414a |
| cve_search |  | https://git.kernel.org/stable/c/7ffff0cc929fdfc62a74b384c4903d6496c910f0 |
| cve_search |  | https://git.kernel.org/stable/c/b17a886ed29f3b70b78ccf632dad03e0c69e3c1a |
| cve_search |  | https://git.kernel.org/stable/c/0d4e0afdd6658cd21dd5be61880411a2553fd1fc |
| cve_search |  | https://git.kernel.org/stable/c/008b807fe487e0b15a3a6c39add4eb477f73e440 |
| cve_search |  | https://git.kernel.org/stable/c/2087d53a66e97a5eb5d1bf558d5bef9e5f891757 |
| cve_search |  | https://git.kernel.org/stable/c/3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2023-52881 | https://explore.alas.aws.amazon.com/CVE-2023-52881.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52881 | https://explore.alas.aws.amazon.com/CVE-2023-52881.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| linux_kernel | 4.14.333 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=69eae75ca525Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=354e4aa391ed | linuxkernelcves |
| linux_kernel | 4.19.302 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=458f07ffeccdIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=354e4aa391ed | linuxkernelcves |
| linux_kernel | 5.4.264 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=7ffff0cc929fIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=354e4aa391ed | linuxkernelcves |
| linux_kernel | 5.10.204 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b17a886ed29fIssue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=354e4aa391ed | linuxkernelcves |
| linux_kernel | 5.15.143 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0d4e0afdd665Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=354e4aa391ed | linuxkernelcves |
| linux_kernel | 6.1.68 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=008b807fe487Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=354e4aa391ed | linuxkernelcves |
| linux_kernel | 6.6.7 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2087d53a66e9Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=354e4aa391ed | linuxkernelcves |
| linux_kernel | 6.7 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2087d53a66e9Issue | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=354e4aa391ed | linuxkernelcves |
| linux |  | https://git.kernel.org/linus/3d501dd326fb1c73f1b8206d4c6e1d7b15c07e27 | https://git.kernel.org/linus/354e4aa391ed50a4d827ff6fc11e0667d0859b25 | ubuntu |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:tcp: do not accept ACK of bytes we never sentThis patch is based on a detailed report and ideas from Yepeng Panand Christian Rossow.ACK seq validation is currently following RFC 5961 5.2 guidelines:   The ACK value is considered acceptable only if   it is in the range of ((SND.UNA - MAX.SND.WND) <= SEG.ACK <=   SND.NXT).  All incoming segments whose ACK value doesn t satisfy the   above condition MUST be discarded and an ACK sent back.  It needs to   be noted that RFC 793 on page 72 (fifth check) says:  If the ACK is a   duplicate (SEG.ACK < SND.UNA), it can be ignored.  If the ACK   acknowledges something not yet sent (SEG.ACK > SND.NXT) then send an   ACK, drop the segment, and return .  The  ignored  above implies that   the processing of the incoming data segment continues, which means   the ACK value is treated as acceptable.  This mitigation makes the   ACK check more stringent since any ACK < SND.UNA wouldn t be   accepted, instead only ACKs that are in the range ((SND.UNA -   MAX.SND.WND) <= SEG.ACK <= SND.NXT) get through.This can be refined for new (and possibly spoofed) flows,by not accepting ACK for bytes that were never sent.This greatly improves TCP security at a little cost.I added a Fixes: tag to make sure this patch will reach stable trees,even if the  blamed  patch was adhering to the RFC.tp->bytes_acked was added in linux-4.2Following packetdrill test (courtesy of Yepeng Pan) showsthe issue at hand:0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0+0 bind(3, ..., ...) = 0+0 listen(3, 1024) = 0// ---------------- Handshake ------------------- //// when window scale is set to 14 the window size can be extended to// 65535 * (2^14) = 1073725440. Linux would accept an ACK packet// with ack number in (Server_ISN+1-1073725440. Server_ISN+1)// ,though this ack number acknowledges some data never// sent by the server.+0 < S 0:0(0) win 65535 <mss 1400,nop,wscale 14>+0 > S. 0:0(0) ack 1 <...>+0 < . 1:1(0) ack 1 win 65535+0 accept(3, ..., ...) = 4// For the established connection, we send an ACK packet,// the ack packet uses ack number 1 - 1073725300 + 2^32,// where 2^32 is used to wrap around.// Note: we used 1073725300 instead of 1073725440 to avoid possible// edge cases.// 1 - 1073725300 + 2^32 = 3221241997// Oops, old kernels happily accept this packet.+0 < . 1:1001(1000) ack 3221241997 win 65535// After the kernel fix the following will be replaced by a challenge ACK,// and prior malicious frame would be dropped.+0 > . 1:1(0) ack 1001
 openEuler评分：
  5.9
 Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):不受影响
4.master(6.6.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP1(5.10.0):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.master(6.6.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-22.03-LTS-SP4(5.10.0):否
8.openEuler-24.03-LTS-SP1(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.openEuler-22.03-LTS-SP3(5.10.0):正常修复
3.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-1094

src-openEuler/kernel
关闭

内容风险标识

评论 (39)

src-openEuler/kernel关闭 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-52881

评论 (39)

搜索帮助

src-openEuler/kernel
关闭