Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-52487— net/mlx5e: Fix peer flow lists handling

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mlx5e_tc_del_fdb_peers_flow 存在安全漏洞。

AI Predicted 7.8 Difficulty: Moderate EPSS 0.27% · P18

Possible ATT&CK Techniques 1 AI

T1205.001 · Port Knocking

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6< 74cec142f89bf85c6c99c5db957da9f663f9f16f affected
9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6< e24d6f5a7f2d95a98a46257a5a5a5381d572894f affected
9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6< d76fdd31f953ac5046555171620f2562715e9b71 affected
6.5 affected
< 6.5 unaffected
6.6.15≤ 6.6.* unaffected
6.7.3≤ 6.7.* unaffected
6.8≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-52487

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net/mlx5e: Fix peer flow lists handling
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix peer flow lists handling The cited change refactored mlx5e_tc_del_fdb_peer_flow() to only clear DUP flag when list of peer flows has become empty. However, if any concurrent user holds a reference to a peer flow (for example, the neighbor update workqueue task is updating peer flow's parent encap entry concurrently), then the flow will not be removed from the peer list and, consecutively, DUP flag will remain set. Since mlx5e_tc_del_fdb_peers_flow() calls mlx5e_tc_del_fdb_peer_flow() for every possible peer index the algorithm will try to remove the flow from eswitch instances that it has never peered with causing either NULL pointer dereference when trying to remove the flow peer list head of peer_index that was never initialized or a warning if the list debug config is enabled[0]. Fix the issue by always removing the peer flow from the list even when not releasing the last reference to it. [0]: [ 3102.985806] ------------[ cut here ]------------ [ 3102.986223] list_del corruption, ffff888139110698->next is NULL [ 3102.986757] WARNING: CPU: 2 PID: 22109 at lib/list_debug.c:53 __list_del_entry_valid_or_report+0x4f/0xc0 [ 3102.987561] Modules linked in: act_ct nf_flow_table bonding act_tunnel_key act_mirred act_skbedit vxlan cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa openvswitch nsh xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcg ss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core [last unloaded: bonding] [ 3102.991113] CPU: 2 PID: 22109 Comm: revalidator28 Not tainted 6.6.0-rc6+ #3 [ 3102.991695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 3102.992605] RIP: 0010:__list_del_entry_valid_or_report+0x4f/0xc0 [ 3102.993122] Code: 39 c2 74 56 48 8b 32 48 39 fe 75 62 48 8b 51 08 48 39 f2 75 73 b8 01 00 00 00 c3 48 89 fe 48 c7 c7 48 fd 0a 82 e8 41 0b ad ff <0f> 0b 31 c0 c3 48 89 fe 48 c7 c7 70 fd 0a 82 e8 2d 0b ad ff 0f 0b [ 3102.994615] RSP: 0018:ffff8881383e7710 EFLAGS: 00010286 [ 3102.995078] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 [ 3102.995670] RDX: 0000000000000001 RSI: ffff88885f89b640 RDI: ffff88885f89b640 [ 3102.997188] DEL flow 00000000be367878 on port 0 [ 3102.998594] RBP: dead000000000122 R08: 0000000000000000 R09: c0000000ffffdfff [ 3102.999604] R10: 0000000000000008 R11: ffff8881383e7598 R12: dead000000000100 [ 3103.000198] R13: 0000000000000002 R14: ffff888139110000 R15: ffff888101901240 [ 3103.000790] FS: 00007f424cde4700(0000) GS:ffff88885f880000(0000) knlGS:0000000000000000 [ 3103.001486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3103.001986] CR2: 00007fd42e8dcb70 CR3: 000000011e68a003 CR4: 0000000000370ea0 [ 3103.002596] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3103.003190] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3103.003787] Call Trace: [ 3103.004055] <TASK> [ 3103.004297] ? __warn+0x7d/0x130 [ 3103.004623] ? __list_del_entry_valid_or_report+0x4f/0xc0 [ 3103.005094] ? report_bug+0xf1/0x1c0 [ 3103.005439] ? console_unlock+0x4a/0xd0 [ 3103.005806] ? handle_bug+0x3f/0x70 [ 3103.006149] ? exc_invalid_op+0x13/0x60 [ 3103.006531] ? asm_exc_invalid_op+0x16/0x20 [ 3103.007430] ? __list_del_entry_valid_or_report+0x4f/0xc0 [ 3103.007910] mlx5e_tc_del_fdb_peers_flow+0xcf/0x240 [mlx5_core] [ 3103.008463] mlx5e_tc_del_flow+0x46/0x270 [mlx5_core] [ 3103.008944] mlx5e_flow_put+0x26/0x50 [mlx5_core] [ 3103.009401] mlx5e_delete_flower+0x25f/0x380 [mlx5_core] [ 3103.009901] tc_setup_cb_destroy+0xab/0x180 [ 3103.010292] fl_hw_destroy_filter+0x99/0xc0 [cls_flower] [ 3103.010779] __fl_delete+0x2d4/0x2f0 [cls_flower] [ 3103.0 ---truncated---
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mlx5e_tc_del_fdb_peers_flow 存在安全漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6 ~ 74cec142f89bf85c6c99c5db957da9f663f9f16f -
Linux Linux 6.5 -

II. Public POCs for CVE-2023-52487

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-52487

请登录查看更多情报信息。

Patches & Fixes for CVE-2023-52487 (2)

Other References for CVE-2023-52487 (1)

Same Patch Batch · Linux · 2024-02-29 · 53 CVEs total

CVE-2023-52480 9.8 CRITICAL ksmbd: fix race condition between session lookup and expire
CVE-2023-52478 8.8 HIGH HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
CVE-2023-52479 8.8 HIGH ksmbd: fix uaf in smb20_oplock_break_ack
CVE-2024-26620 8.2 HIGH s390/vfio-ap: always filter entire AP matrix
CVE-2021-47061 7.8 HIGH KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU
CVE-2023-52483 7.8 HIGH mctp: perform route lookups under a RCU read-side lock
CVE-2021-47068 7.8 HIGH net/nfc: fix use-after-free llcp_sock_bind/connect
CVE-2023-52486 7.8 HIGH drm: Don't unref the same fb many times by mistake due to deadlock handling
CVE-2023-52491 7.8 HIGH media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_
CVE-2021-47060 7.8 HIGH KVM: Stop looking for coalesced MMIO zones if the bus is destroyed
CVE-2024-26608 7.8 HIGH ksmbd: fix global oob in ksmbd_nl_policy
CVE-2024-26610 7.8 HIGH wifi: iwlwifi: fix a memory corruption
CVE-2024-26614 7.8 HIGH tcp: make sure init the accept_queue's spinlocks once
CVE-2024-26617 7.8 HIGH fs/proc/task_mmu: move mmu notification mechanism inside mm lock
CVE-2024-26611 7.5 HIGH xsk: fix usage of multi-buffer BPF helpers for ZC XDP
CVE-2021-47066 7.1 HIGH async_xor: increase src_offs when dropping destination page
CVE-2021-47055 7.1 HIGH mtd: require write permissions for locking and badblock ioctls
CVE-2023-52497 7.1 HIGH erofs: fix lz4 inplace decompression
CVE-2021-47054 bus: qcom: Put child node before return
CVE-2021-47065 rtw88: Fix array overrun in rtw_get_tx_power_params()

Showing top 20 of 53 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2023-52487

No comments yet

Leave a comment