CVE-2023-53667— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于处理dwNtbOutMaxSize值过低时内存分配不当，可能导致内存损坏。
可能的 ATT&CK 技术 1 AI
T1499.001 · OS Exhaustion Flood影响版本矩阵 18
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 289507d3364f96f4b8814726917d572f71350d87< 2334ff0b343ba6ba7a6c0586fcc83992bbbc1776 |
affected |
289507d3364f96f4b8814726917d572f71350d87< bf415bfe7573596ac213b4fd1da9e62cfc9a9413 |
affected | ||
289507d3364f96f4b8814726917d572f71350d87< ff484163dfb61b58f23e4dbd007de1094427669c |
affected | ||
289507d3364f96f4b8814726917d572f71350d87< 42b78c8cc774b47023d6d16d96d54cc7015e4a07 |
affected | ||
289507d3364f96f4b8814726917d572f71350d87< 9be921854e983a81a0aeeae5febcd87093086e46 |
affected | ||
289507d3364f96f4b8814726917d572f71350d87< 6147745d43ff4e0d2c542e5b93e398ef0ee4db00 |
affected | ||
289507d3364f96f4b8814726917d572f71350d87< 72d0240b0ee4794efc683975c213e4b384fea733 |
affected | ||
289507d3364f96f4b8814726917d572f71350d87< 7e01c7f7046efc2c7c192c3619db43292b98e997 |
affected | ||
| … +10 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2023-53667 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
Currently in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is lower than
the calculated "min" value, but greater than zero, the logic sets
tx_max to dwNtbOutMaxSize. This is then used to allocate a new SKB in
cdc_ncm_fill_tx_frame() where all the data is handled.
For small values of dwNtbOutMaxSize the memory allocated during
alloc_skb(dwNtbOutMaxSize, GFP_ATOMIC) will have the same size, due to
how size is aligned at alloc time:
size = SKB_DATA_ALIGN(size);
size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
Thus we hit the same bug that we tried to squash with
commit 2be6d4d16a084 ("net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero")
Low values of dwNtbOutMaxSize do not cause an issue presently because at
alloc_skb() time more memory (512b) is allocated than required for the
SKB headers alone (320b), leaving some space (512b - 320b = 192b)
for CDC data (172b).
However, if more elements (for example 3 x u64 = [24b]) were added to
one of the SKB header structs, say 'struct skb_shared_info',
increasing its original size (320b [320b aligned]) to something larger
(344b [384b aligned]), then suddenly the CDC data (172b) no longer
fits in the spare SKB data area (512b - 384b = 128b).
Consequently the SKB bounds checking semantics fails and panics:
skbuff: skb_over_panic: text:ffffffff831f755b len:184 put:172 head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 dev:<NULL>
------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:113!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 57 Comm: kworker/0:2 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023
Workqueue: mld mld_ifc_work
RIP: 0010:skb_panic net/core/skbuff.c:113 [inline]
RIP: 0010:skb_over_panic+0x14c/0x150 net/core/skbuff.c:118
[snip]
Call Trace:
<TASK>
skb_put+0x151/0x210 net/core/skbuff.c:2047
skb_put_zero include/linux/skbuff.h:2422 [inline]
cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1131 [inline]
cdc_ncm_fill_tx_frame+0x11ab/0x3da0 drivers/net/usb/cdc_ncm.c:1308
cdc_ncm_tx_fixup+0xa3/0x100
Deal with too low values of dwNtbOutMaxSize, clamp it in the range
[USB_CDC_NCM_NTB_MIN_OUT_SIZE, CDC_NCM_NTB_MAX_SIZE_TX]. We ensure
enough data space is allocated to handle CDC data by making sure
dwNtbOutMaxSize is not smaller than USB_CDC_NCM_NTB_MIN_OUT_SIZE.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于处理dwNtbOutMaxSize值过低时内存分配不当，可能导致内存损坏。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2023-53667 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2023-53667 的情报信息
请登录查看更多情报信息。
CVE-2023-53667 补丁与修复 (1)
同批安全公告 · Linux · 2025-10-07 · 共 118 条
| CVE-2023-53629 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2023-53673 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-53675 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-53676 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-53630 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-53679 | 8.3 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-53635 | 8.2 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-50528 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-53659 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-53660 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-53619 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-53643 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-53645 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-53646 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-53669 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-53626 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-53627 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-50517 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-50518 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-50543 | 7.8 HIGH | Linux kernel 安全漏洞 |
显示前 20 条，共 118 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2023-53667
暂无评论