CVE-2023-53469

一、漏洞信息
 漏洞编号：[CVE-2023-53469](https://nvd.nist.gov/vuln/detail/CVE-2023-53469)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:af_unix: Fix null-ptr-deref in unix_stream_sendpage().Bing-Jhong Billy Jheng reported null-ptr-deref in unix_stream_sendpage()with detailed analysis and a nice repro.unix_stream_sendpage() tries to add data to the last skb in the peer srecv queue without locking the queue.If the peer s FD is passed to another socket and the socket s FD ispassed to the peer, there is a loop between them.  If we close bothsockets without receiving FD, the sockets will be cleaned up by garbagecollection.The garbage collection iterates such sockets and unlinks skb withFD from the socket s receive queue under the queue s lock.So, there is a race where unix_stream_sendpage() could access an skblocklessly that is being released by garbage collection, resulting inuse-after-free.To avoid the issue, unix_stream_sendpage() must lock the peer s recvqueue.Note the issue does not exist in 6.5+ thanks to the recent sendpage()refactoring.This patch is originally written by Linus Torvalds.BUG: unable to handle page fault for address: ffff988004dd6870PF: supervisor read access in kernel modePF: error_code(0x0000) - not-present pagePGD 0 P4D 0PREEMPT SMP PTICPU: 4 PID: 297 Comm: garbage_uaf Not tainted 6.1.46 #1Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014RIP: 0010:kmem_cache_alloc_node+0xa2/0x1e0Code: c0 0f 84 32 01 00 00 41 83 fd ff 74 10 48 8b 00 48 c1 e8 3a 41 39 c5 0f 85 1c 01 00 00 41 8b 44 24 28 49 8b 3c 24 48 8d 4a 40 <49> 8b 1c 06 4c 89 f0 65 48 0f c7 0f 0f 94 c0 84 c0 74 a1 41 8b 44RSP: 0018:ffffc9000079fac0 EFLAGS: 00000246RAX: 0000000000000070 RBX: 0000000000000005 RCX: 000000000001a284RDX: 000000000001a244 RSI: 0000000000400cc0 RDI: 000000000002eee0RBP: 0000000000400cc0 R08: 0000000000400cc0 R09: 0000000000000003R10: 0000000000000001 R11: 0000000000000000 R12: ffff888003970f00R13: 00000000ffffffff R14: ffff988004dd6800 R15: 00000000000000e8FS:  00007f174d6f3600(0000) GS:ffff88807db00000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: ffff988004dd6870 CR3: 00000000092be000 CR4: 00000000007506e0PKRU: 55555554Call Trace: <TASK> ? __die_body.cold+0x1a/0x1f ? page_fault_oops+0xa9/0x1e0 ? fixup_exception+0x1d/0x310 ? exc_page_fault+0xa8/0x150 ? asm_exc_page_fault+0x22/0x30 ? kmem_cache_alloc_node+0xa2/0x1e0 ? __alloc_skb+0x16c/0x1e0 __alloc_skb+0x16c/0x1e0 alloc_skb_with_frags+0x48/0x1e0 sock_alloc_send_pskb+0x234/0x270 unix_stream_sendmsg+0x1f5/0x690 sock_sendmsg+0x5d/0x60 ____sys_sendmsg+0x210/0x260 ___sys_sendmsg+0x83/0xd0 ? kmem_cache_alloc+0xc6/0x1c0 ? avc_disable+0x20/0x20 ? percpu_counter_add_batch+0x53/0xc0 ? alloc_empty_file+0x5d/0xb0 ? alloc_file+0x91/0x170 ? alloc_file_pseudo+0x94/0x100 ? __fget_light+0x9f/0x120 __sys_sendmsg+0x54/0xa0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x69/0xd3RIP: 0033:0x7f174d639a7dCode: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 8a c1 f4 ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 de c1 f4 ff 48RSP: 002b:00007ffcb563ea50 EFLAGS: 00000293 ORIG_RAX: 000000000000002eRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f174d639a7dRDX: 0000000000000000 RSI: 00007ffcb563eab0 RDI: 0000000000000007RBP: 00007ffcb563eb10 R08: 0000000000000000 R09: 00000000ffffffffR10: 00000000004040a0 R11: 0000000000000293 R12: 00007ffcb563ec28R13: 0000000000401398 R14: 0000000000403e00 R15: 00007f174d72c000 </TASK>
 漏洞公开时间：2025-10-01 20:15:48
 漏洞创建时间：2025-10-01 20:37:48
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2023-53469
<details>
<summary>更多参考(点击展开)</summary>

无
</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://git.kernel.org/stable/c/4a3fcfc3b51796e5e6974041c9a7cf7808d16f9e |  | ljqc |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
          In the Linux kernel, the following vulnerability has been resolved:af_unix: Fix null-ptr-deref in unix_stream_sendpage().Bing-Jhong Billy Jheng reported null-ptr-deref in unix_stream_sendpage()with detailed analysis and a nice repro.unix_stream_sendpage() tries to add data to the last skb in the peer srecv queue without locking the queue.If the peer s FD is passed to another socket and the socket s FD ispassed to the peer, there is a loop between them.  If we close bothsockets without receiving FD, the sockets will be cleaned up by garbagecollection.The garbage collection iterates such sockets and unlinks skb withFD from the socket s receive queue under the queue s lock.So, there is a race where unix_stream_sendpage() could access an skblocklessly that is being released by garbage collection, resulting inuse-after-free.To avoid the issue, unix_stream_sendpage() must lock the peer s recvqueue.Note the issue does not exist in 6.5+ thanks to the recent sendpage()refactoring.This patch is originally written by Linus Torvalds.BUG: unable to handle page fault for address: ffff988004dd6870PF: supervisor read access in kernel modePF: error_code(0x0000) - not-present pagePGD 0 P4D 0PREEMPT SMP PTICPU: 4 PID: 297 Comm: garbage_uaf Not tainted 6.1.46 #1Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014RIP: 0010:kmem_cache_alloc_node+0xa2/0x1e0Code: c0 0f 84 32 01 00 00 41 83 fd ff 74 10 48 8b 00 48 c1 e8 3a 41 39 c5 0f 85 1c 01 00 00 41 8b 44 24 28 49 8b 3c 24 48 8d 4a 40 <49> 8b 1c 06 4c 89 f0 65 48 0f c7 0f 0f 94 c0 84 c0 74 a1 41 8b 44RSP: 0018:ffffc9000079fac0 EFLAGS: 00000246RAX: 0000000000000070 RBX: 0000000000000005 RCX: 000000000001a284RDX: 000000000001a244 RSI: 0000000000400cc0 RDI: 000000000002eee0RBP: 0000000000400cc0 R08: 0000000000400cc0 R09: 0000000000000003R10: 0000000000000001 R11: 0000000000000000 R12: ffff888003970f00R13: 00000000ffffffff R14: ffff988004dd6800 R15: 00000000000000e8FS:  00007f174d6f3600(0000) GS:ffff88807db00000(0000) knlGS:0000000000000000CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: ffff988004dd6870 CR3: 00000000092be000 CR4: 00000000007506e0PKRU: 55555554Call Trace: <TASK> ? __die_body.cold+0x1a/0x1f ? page_fault_oops+0xa9/0x1e0 ? fixup_exception+0x1d/0x310 ? exc_page_fault+0xa8/0x150 ? asm_exc_page_fault+0x22/0x30 ? kmem_cache_alloc_node+0xa2/0x1e0 ? __alloc_skb+0x16c/0x1e0 __alloc_skb+0x16c/0x1e0 alloc_skb_with_frags+0x48/0x1e0 sock_alloc_send_pskb+0x234/0x270 unix_stream_sendmsg+0x1f5/0x690 sock_sendmsg+0x5d/0x60 ____sys_sendmsg+0x210/0x260 ___sys_sendmsg+0x83/0xd0 ? kmem_cache_alloc+0xc6/0x1c0 ? avc_disable+0x20/0x20 ? percpu_counter_add_batch+0x53/0xc0 ? alloc_empty_file+0x5d/0xb0 ? alloc_file+0x91/0x170 ? alloc_file_pseudo+0x94/0x100 ? __fget_light+0x9f/0x120 __sys_sendmsg+0x54/0xa0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x69/0xd3RIP: 0033:0x7f174d639a7dCode: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 8a c1 f4 ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 de c1 f4 ff 48RSP: 002b:00007ffcb563ea50 EFLAGS: 00000293 ORIG_RAX: 000000000000002eRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f174d639a7dRDX: 0000000000000000 RSI: 00007ffcb563eab0 RDI: 0000000000000007RBP: 00007ffcb563eb10 R08: 0000000000000000 R09: 00000000ffffffffR10: 00000000004040a0 R11: 0000000000000293 R12: 00007ffcb563ec28R13: 0000000000401398 R14: 0000000000403e00 R15: 00007f174d72c000 </TASK>    
 openEuler评分：
  4.7
 Vector：CVSS：3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(4.19.90):受影响
2.openEuler-22.03-LTS-SP3(5.10.0):受影响
3.openEuler-22.03-LTS-SP4(5.10.0):受影响
4.master(6.12.33):不受影响
5.openEuler-24.03-LTS:不受影响
6.openEuler-24.03-LTS-Next:不受影响
7.openEuler-24.03-LTS-SP1:不受影响
8.openEuler-24.03-LTS-SP2:不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS:否
6.openEuler-24.03-LTS-Next:否
7.openEuler-24.03-LTS-SP1:否
8.openEuler-24.03-LTS-SP2:否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):正常修复
2.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
3.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
4.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS:不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next:不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1:不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-SP2:不受影响-漏洞代码不能被攻击者触发

src-openEuler/kernel

内容风险标识

评论 (5)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2023-53469

评论 (5)

搜索帮助

src-openEuler/kernel