Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2023-53053— erspan: do not use skb_mac_header() in ndo_start_xmit()

AI Predicted 6.5 Difficulty: Moderate EPSS 0.22% · P12

Affected Version Matrix 16

VendorProductVersion RangeStatus
LinuxLinux1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2< da149daf821a3c05cd04f7c60776c86c5ee9685caffected
1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2< b72f453e886af532bde1fd049a2d2421999630d3affected
1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2< f8cec30541f5c5cc218e9a32138d45d227727f2faffected
1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2< b41f37dbd9cdb60000e3b0dfad6df787591c2265affected
1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2< 9c7d6803689c99d55bbb862260d0ba486ff23c0baffected
1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2< 5d4172732f0ee1639a361a6cc5c3114bbb397386affected
1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2< 8e50ed774554f93d55426039b27b1e38d7fa64d8affected
4.18affected
… +8 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2023-53053

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
erspan: do not use skb_mac_header() in ndo_start_xmit()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: erspan: do not use skb_mac_header() in ndo_start_xmit() Drivers should not assume skb_mac_header(skb) == skb->data in their ndo_start_xmit(). Use skb_network_offset() and skb_transport_offset() which better describe what is needed in erspan_fb_xmit() and ip6erspan_tunnel_xmit() syzbot reported: WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 skb_mac_header include/linux/skbuff.h:2873 [inline] WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962 Modules linked in: CPU: 0 PID: 5083 Comm: syz-executor406 Not tainted 6.3.0-rc2-syzkaller-00866-gd4671cb96fa3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023 RIP: 0010:skb_mac_header include/linux/skbuff.h:2873 [inline] RIP: 0010:ip6erspan_tunnel_xmit+0x1d9c/0x2d90 net/ipv6/ip6_gre.c:962 Code: 04 02 41 01 de 84 c0 74 08 3c 03 0f 8e 1c 0a 00 00 45 89 b4 24 c8 00 00 00 c6 85 77 fe ff ff 01 e9 33 e7 ff ff e8 b4 27 a1 f8 <0f> 0b e9 b6 e7 ff ff e8 a8 27 a1 f8 49 8d bf f0 0c 00 00 48 b8 00 RSP: 0018:ffffc90003b2f830 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 000000000000ffff RCX: 0000000000000000 RDX: ffff888021273a80 RSI: ffffffff88e1bd4c RDI: 0000000000000003 RBP: ffffc90003b2f9d8 R08: 0000000000000003 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000000 R12: ffff88802b28da00 R13: 00000000000000d0 R14: ffff88807e25b6d0 R15: ffff888023408000 FS: 0000555556a61300(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055e5b11eb6e8 CR3: 0000000027c1b000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __netdev_start_xmit include/linux/netdevice.h:4900 [inline] netdev_start_xmit include/linux/netdevice.h:4914 [inline] __dev_direct_xmit+0x504/0x730 net/core/dev.c:4300 dev_direct_xmit include/linux/netdevice.h:3088 [inline] packet_xmit+0x20a/0x390 net/packet/af_packet.c:285 packet_snd net/packet/af_packet.c:3075 [inline] packet_sendmsg+0x31a0/0x5150 net/packet/af_packet.c:3107 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0xde/0x190 net/socket.c:747 __sys_sendto+0x23a/0x340 net/socket.c:2142 __do_sys_sendto net/socket.c:2154 [inline] __se_sys_sendto net/socket.c:2150 [inline] __x64_sys_sendto+0xe1/0x1b0 net/socket.c:2150 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f123aaa1039 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 b1 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc15d12058 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f123aaa1039 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000020000040 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f123aa648c0 R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于erspan驱动在ndo_start_xmit中错误使用skb_mac_header，可能导致内存访问错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux 1baf5ebf8954d9bff8fa4e7dd6c416a0cebdb9e2 ~ da149daf821a3c05cd04f7c60776c86c5ee9685c -
LinuxLinux 4.18 -

II. Public POCs for CVE-2023-53053

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-53053

请登录查看更多情报信息。

Patches & Fixes for CVE-2023-53053 (7)

Same Patch Batch · Linux · 2025-05-02 · 107 CVEs total

CVE-2023-531169.8 CRITICALnvmet: avoid potential UAF in nvmet_req_complete()
CVE-2023-530839.8 CRITICALnfsd: don't replace page in rq_pages if it's a continuation of last page
CVE-2023-530868.8 HIGHwifi: mt76: connac: do not check WED status for non-mmio devices
CVE-2025-377987.8 HIGHcodel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
CVE-2023-531387.8 HIGHnet: caif: Fix use-after-free in cfusbl_device_notify()
CVE-2023-531117.8 HIGHloop: Fix use-after-free issues
CVE-2023-531077.8 HIGHveth: Fix use after free in XDP_REDIRECT
CVE-2023-531027.8 HIGHice: xsk: disable txq irq before flushing hw
CVE-2023-531007.8 HIGHext4: fix WARNING in ext4_update_inline_data
CVE-2023-530947.8 HIGHtty: serial: fsl_lpuart: fix race on RX DMA shutdown
CVE-2023-530907.8 HIGHdrm/amdkfd: Fix an illegal memory access
CVE-2023-530887.8 HIGHmptcp: fix UaF in listener shutdown
CVE-2023-530877.8 HIGHdrm/i915/active: Fix misuse of non-idle barriers as fence trackers
CVE-2023-530847.8 HIGHdrm/shmem-helper: Remove another errant put in error path
CVE-2023-530807.8 HIGHxsk: Add missing overflow check in xdp_umem_reg
CVE-2023-530727.8 HIGHmptcp: use the workqueue to destroy unaccepted sockets
CVE-2023-530657.8 HIGHperf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output
CVE-2023-530577.8 HIGHBluetooth: HCI: Fix global-out-of-bounds
CVE-2023-530527.8 HIGHcifs: fix use-after-free bug in refresh_cache_worker()
CVE-2023-530437.8 HIGHarm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent

Showing top 20 of 107 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2023-53053

No comments yet

Leave a comment