CVE-2023-53021

一、漏洞信息
 漏洞编号：[CVE-2023-53021](https://nvd.nist.gov/vuln/detail/CVE-2023-53021)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：7.8 High
  Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:net/sched: sch_taprio: fix possible use-after-freesyzbot reported a nasty crash [1] in net_tx_action() whichmade little sense until we got a repro.This repro installs a taprio qdisc, but providing aninvalid TCA_RATE attribute.qdisc_create() has to destroy the just initializedtaprio qdisc, and taprio_destroy() is called.However, the hrtimer used by taprio had already fired,therefore advance_sched() called __netif_schedule().Then net_tx_action was trying to use a destroyed qdisc.We can not undo the __netif_schedule(), so we must waituntil one cpu serviced the qdisc before we can proceed.Many thanks to Alexander Potapenko for his help.[1]BUG: KMSAN: uninit-value in queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline]BUG: KMSAN: uninit-value in do_raw_spin_trylock include/linux/spinlock.h:191 [inline]BUG: KMSAN: uninit-value in __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline]BUG: KMSAN: uninit-value in _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline] do_raw_spin_trylock include/linux/spinlock.h:191 [inline] __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline] _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 spin_trylock include/linux/spinlock.h:359 [inline] qdisc_run_begin include/net/sch_generic.h:187 [inline] qdisc_run+0xee/0x540 include/net/pkt_sched.h:125 net_tx_action+0x77c/0x9a0 net/core/dev.c:5086 __do_softirq+0x1cc/0x7fb kernel/softirq.c:571 run_ksoftirqd+0x2c/0x50 kernel/softirq.c:934 smpboot_thread_fn+0x554/0x9f0 kernel/smpboot.c:164 kthread+0x31b/0x430 kernel/kthread.c:376 ret_from_fork+0x1f/0x30Uninit was created at: slab_post_alloc_hook mm/slab.h:732 [inline] slab_alloc_node mm/slub.c:3258 [inline] __kmalloc_node_track_caller+0x814/0x1250 mm/slub.c:4970 kmalloc_reserve net/core/skbuff.c:358 [inline] __alloc_skb+0x346/0xcf0 net/core/skbuff.c:430 alloc_skb include/linux/skbuff.h:1257 [inline] nlmsg_new include/net/netlink.h:953 [inline] netlink_ack+0x5f3/0x12b0 net/netlink/af_netlink.c:2436 netlink_rcv_skb+0x55d/0x6c0 net/netlink/af_netlink.c:2507 rtnetlink_rcv+0x30/0x40 net/core/rtnetlink.c:6108 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x1288/0x1440 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0xabc/0xe90 net/socket.c:2482 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2536 __sys_sendmsg net/socket.c:2565 [inline] __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __x64_sys_sendmsg+0x367/0x540 net/socket.c:2572 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcdCPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 6.0.0-rc2-syzkaller-47461-gac3859c02d7f #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
 漏洞公开时间：2025-03-28 01:15:51
 漏洞创建时间：2025-03-28 02:12:13
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-53021
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/1200388a0b1c3c6fda48d4d2143db8f7e4ef5348 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/3a415d59c1dbec9d772dbfab2d2520d98360caae |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c53acbf2facfdfabdc6e6984a1a38f5d38b606a1 |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/c60fe70078d6e515f424cb868d07e00411b27fbc |  |
| 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | https://git.kernel.org/stable/c/d3b2d2820a005e43855fa71b80c4a4b194201c60 |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-53021 | https://bugzilla.suse.com/show_bug.cgi?id=1240219 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2023-53021 | https://bugzilla.suse.com/show_bug.cgi?id=1240219 |
| suse_bugzilla | https://git.kernel.org/stable/c/1200388a0b1c3c6fda48d4d2143db8f7e4ef5348 | https://bugzilla.suse.com/show_bug.cgi?id=1240219 |
| suse_bugzilla | https://git.kernel.org/stable/c/3a415d59c1dbec9d772dbfab2d2520d98360caae | https://bugzilla.suse.com/show_bug.cgi?id=1240219 |
| suse_bugzilla | https://git.kernel.org/stable/c/c53acbf2facfdfabdc6e6984a1a38f5d38b606a1 | https://bugzilla.suse.com/show_bug.cgi?id=1240219 |
| suse_bugzilla | https://git.kernel.org/stable/c/c60fe70078d6e515f424cb868d07e00411b27fbc | https://bugzilla.suse.com/show_bug.cgi?id=1240219 |
| suse_bugzilla | https://git.kernel.org/stable/c/d3b2d2820a005e43855fa71b80c4a4b194201c60 | https://bugzilla.suse.com/show_bug.cgi?id=1240219 |
| suse_bugzilla | https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2023/CVE-2023-53021.mbox | https://bugzilla.suse.com/show_bug.cgi?id=1240219 |
| suse_bugzilla | https://github.com/CVEProject/cvelistV5/blob/main//cves/2023/53xxx/CVE-2023-53021.json | https://bugzilla.suse.com/show_bug.cgi?id=1240219 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2355484 | https://bugzilla.suse.com/show_bug.cgi?id=1240219 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025032718-CVE-2023-53021-def9@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2355484 |
| redhat_bugzilla | https://lore.kernel.org/linux-cve-announce/2025032718-CVE-2023-53021-def9@gregkh/T | https://bugzilla.redhat.com/show_bug.cgi?id=2355484 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2023-53021 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2023-53021 |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://git.kernel.org/stable/c/1200388a0b1c3c6fda48d4d2143db8f7e4ef5348 |  | nvd |
|  |  | https://git.kernel.org/stable/c/3a415d59c1dbec9d772dbfab2d2520d98360caae |  | nvd |
|  |  | https://git.kernel.org/stable/c/c53acbf2facfdfabdc6e6984a1a38f5d38b606a1 |  | nvd |
|  |  | https://git.kernel.org/stable/c/c60fe70078d6e515f424cb868d07e00411b27fbc |  | nvd |
|  |  | https://git.kernel.org/stable/c/d3b2d2820a005e43855fa71b80c4a4b194201c60 |  | nvd |
| linux_kernel | 5.4.231 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=1200388a0b1c3c6fda48d4d2143db8f7e4ef5348 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 | linuxkernelcves |
| linux_kernel | 5.10.166 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c60fe70078d6e515f424cb868d07e00411b27fbc | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 | linuxkernelcves |
| linux_kernel | 5.15.91 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c53acbf2facfdfabdc6e6984a1a38f5d38b606a1 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 | linuxkernelcves |
| linux_kernel | 6.1.9 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d3b2d2820a005e43855fa71b80c4a4b194201c60 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 | linuxkernelcves |
| linux_kernel | 6.2 | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3a415d59c1dbec9d772dbfab2d2520d98360caae | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 | linuxkernelcves |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:net/sched: sch_taprio: fix possible use-after-freesyzbot reported a nasty crash [1] in net_tx_action() whichmade little sense until we got a repro.This repro installs a taprio qdisc, but providing aninvalid TCA_RATE attribute.qdisc_create() has to destroy the just initializedtaprio qdisc, and taprio_destroy() is called.However, the hrtimer used by taprio had already fired,therefore advance_sched() called __netif_schedule().Then net_tx_action was trying to use a destroyed qdisc.We can not undo the __netif_schedule(), so we must waituntil one cpu serviced the qdisc before we can proceed.Many thanks to Alexander Potapenko for his help.[1]BUG: KMSAN: uninit-value in queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline]BUG: KMSAN: uninit-value in do_raw_spin_trylock include/linux/spinlock.h:191 [inline]BUG: KMSAN: uninit-value in __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline]BUG: KMSAN: uninit-value in _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 queued_spin_trylock include/asm-generic/qspinlock.h:94 [inline] do_raw_spin_trylock include/linux/spinlock.h:191 [inline] __raw_spin_trylock include/linux/spinlock_api_smp.h:89 [inline] _raw_spin_trylock+0x92/0xa0 kernel/locking/spinlock.c:138 spin_trylock include/linux/spinlock.h:359 [inline] qdisc_run_begin include/net/sch_generic.h:187 [inline] qdisc_run+0xee/0x540 include/net/pkt_sched.h:125 net_tx_action+0x77c/0x9a0 net/core/dev.c:5086 __do_softirq+0x1cc/0x7fb kernel/softirq.c:571 run_ksoftirqd+0x2c/0x50 kernel/softirq.c:934 smpboot_thread_fn+0x554/0x9f0 kernel/smpboot.c:164 kthread+0x31b/0x430 kernel/kthread.c:376 ret_from_fork+0x1f/0x30Uninit was created at: slab_post_alloc_hook mm/slab.h:732 [inline] slab_alloc_node mm/slub.c:3258 [inline] __kmalloc_node_track_caller+0x814/0x1250 mm/slub.c:4970 kmalloc_reserve net/core/skbuff.c:358 [inline] __alloc_skb+0x346/0xcf0 net/core/skbuff.c:430 alloc_skb include/linux/skbuff.h:1257 [inline] nlmsg_new include/net/netlink.h:953 [inline] netlink_ack+0x5f3/0x12b0 net/netlink/af_netlink.c:2436 netlink_rcv_skb+0x55d/0x6c0 net/netlink/af_netlink.c:2507 rtnetlink_rcv+0x30/0x40 net/core/rtnetlink.c:6108 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0xf3b/0x1270 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x1288/0x1440 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0xabc/0xe90 net/socket.c:2482 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2536 __sys_sendmsg net/socket.c:2565 [inline] __do_sys_sendmsg net/socket.c:2574 [inline] __se_sys_sendmsg net/socket.c:2572 [inline] __x64_sys_sendmsg+0x367/0x540 net/socket.c:2572 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcdCPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 6.0.0-rc2-syzkaller-47461-gac3859c02d7f #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
 openEuler评分：
  7.8
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):不受影响
2.openEuler-22.03-LTS-SP3(5.10.0):不受影响
3.openEuler-22.03-LTS-SP4(5.10.0):不受影响
4.master(6.6.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.openEuler-20.03-LTS-SP4(4.19.90):否
2.openEuler-22.03-LTS-SP3(5.10.0):否
3.master(6.6.0):否
4.openEuler-24.03-LTS(6.6.0):否
5.openEuler-24.03-LTS-Next(6.6.0):否
6.openEuler-22.03-LTS-SP4(5.10.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.master(6.6.0):不受影响-漏洞代码不能被攻击者触发
2.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
3.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在
4.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不存在
5.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不存在
6.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不存在
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不存在
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响-漏洞代码不存在

src-openEuler/kernel
Closed

Content Risk Flag

Comments (6)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2023-53021

Comments (6)

Search

src-openEuler/kernel
Closed