CVE-2023-54193— Linux kernel 安全漏洞
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于cls_api未从驱动列表中移除block_cb，可能导致释放后重用。
可能的 ATT&CK 技术 1 AI
T1190 · Exploit Public-Facing Application影响版本矩阵 16
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 59094b1e5094c7e50a3d2912202fd30b6a1dadf8< cc5fe387c6294d0471cb7ed064efac97fac65ccc |
affected |
59094b1e5094c7e50a3d2912202fd30b6a1dadf8< 7311c8be3755611bf6edea4dfbeb190b4bdd489f |
affected | ||
59094b1e5094c7e50a3d2912202fd30b6a1dadf8< cb145932fcf6814e7e95e467eb70e7849a845ae9 |
affected | ||
59094b1e5094c7e50a3d2912202fd30b6a1dadf8< 55866fe3fded3ce94ac3fc1bb3dfce654282f483 |
affected | ||
59094b1e5094c7e50a3d2912202fd30b6a1dadf8< 26aec72429a05e917d574eca0efc5306c63a8862 |
affected | ||
59094b1e5094c7e50a3d2912202fd30b6a1dadf8< 7b7a74ed303d532fb73ae4b1697f16a0fea89cd0 |
affected | ||
59094b1e5094c7e50a3d2912202fd30b6a1dadf8< da94a7781fc3c92e7df7832bc2746f4d39bc624e |
affected | ||
5.3 |
affected | ||
| … +8 条更多 | |||
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2023-54193 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
net/sched: cls_api: remove block_cb from driver_list before freeing
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: cls_api: remove block_cb from driver_list before freeing
Error handler of tcf_block_bind() frees the whole bo->cb_list on error.
However, by that time the flow_block_cb instances are already in the driver
list because driver ndo_setup_tc() callback is called before that up the
call chain in tcf_block_offload_cmd(). This leaves dangling pointers to
freed objects in the list and causes use-after-free[0]. Fix it by also
removing flow_block_cb instances from driver_list before deallocating them.
[0]:
[ 279.868433] ==================================================================
[ 279.869964] BUG: KASAN: slab-use-after-free in flow_block_cb_setup_simple+0x631/0x7c0
[ 279.871527] Read of size 8 at addr ffff888147e2bf20 by task tc/2963
[ 279.873151] CPU: 6 PID: 2963 Comm: tc Not tainted 6.3.0-rc6+ #4
[ 279.874273] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[ 279.876295] Call Trace:
[ 279.876882] <TASK>
[ 279.877413] dump_stack_lvl+0x33/0x50
[ 279.878198] print_report+0xc2/0x610
[ 279.878987] ? flow_block_cb_setup_simple+0x631/0x7c0
[ 279.879994] kasan_report+0xae/0xe0
[ 279.880750] ? flow_block_cb_setup_simple+0x631/0x7c0
[ 279.881744] ? mlx5e_tc_reoffload_flows_work+0x240/0x240 [mlx5_core]
[ 279.883047] flow_block_cb_setup_simple+0x631/0x7c0
[ 279.884027] tcf_block_offload_cmd.isra.0+0x189/0x2d0
[ 279.885037] ? tcf_block_setup+0x6b0/0x6b0
[ 279.885901] ? mutex_lock+0x7d/0xd0
[ 279.886669] ? __mutex_unlock_slowpath.constprop.0+0x2d0/0x2d0
[ 279.887844] ? ingress_init+0x1c0/0x1c0 [sch_ingress]
[ 279.888846] tcf_block_get_ext+0x61c/0x1200
[ 279.889711] ingress_init+0x112/0x1c0 [sch_ingress]
[ 279.890682] ? clsact_init+0x2b0/0x2b0 [sch_ingress]
[ 279.891701] qdisc_create+0x401/0xea0
[ 279.892485] ? qdisc_tree_reduce_backlog+0x470/0x470
[ 279.893473] tc_modify_qdisc+0x6f7/0x16d0
[ 279.894344] ? tc_get_qdisc+0xac0/0xac0
[ 279.895213] ? mutex_lock+0x7d/0xd0
[ 279.896005] ? __mutex_lock_slowpath+0x10/0x10
[ 279.896910] rtnetlink_rcv_msg+0x5fe/0x9d0
[ 279.897770] ? rtnl_calcit.isra.0+0x2b0/0x2b0
[ 279.898672] ? __sys_sendmsg+0xb5/0x140
[ 279.899494] ? do_syscall_64+0x3d/0x90
[ 279.900302] ? entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 279.901337] ? kasan_save_stack+0x2e/0x40
[ 279.902177] ? kasan_save_stack+0x1e/0x40
[ 279.903058] ? kasan_set_track+0x21/0x30
[ 279.903913] ? kasan_save_free_info+0x2a/0x40
[ 279.904836] ? ____kasan_slab_free+0x11a/0x1b0
[ 279.905741] ? kmem_cache_free+0x179/0x400
[ 279.906599] netlink_rcv_skb+0x12c/0x360
[ 279.907450] ? rtnl_calcit.isra.0+0x2b0/0x2b0
[ 279.908360] ? netlink_ack+0x1550/0x1550
[ 279.909192] ? rhashtable_walk_peek+0x170/0x170
[ 279.910135] ? kmem_cache_alloc_node+0x1af/0x390
[ 279.911086] ? _copy_from_iter+0x3d6/0xc70
[ 279.912031] netlink_unicast+0x553/0x790
[ 279.912864] ? netlink_attachskb+0x6a0/0x6a0
[ 279.913763] ? netlink_recvmsg+0x416/0xb50
[ 279.914627] netlink_sendmsg+0x7a1/0xcb0
[ 279.915473] ? netlink_unicast+0x790/0x790
[ 279.916334] ? iovec_from_user.part.0+0x4d/0x220
[ 279.917293] ? netlink_unicast+0x790/0x790
[ 279.918159] sock_sendmsg+0xc5/0x190
[ 279.918938] ____sys_sendmsg+0x535/0x6b0
[ 279.919813] ? import_iovec+0x7/0x10
[ 279.920601] ? kernel_sendmsg+0x30/0x30
[ 279.921423] ? __copy_msghdr+0x3c0/0x3c0
[ 279.922254] ? import_iovec+0x7/0x10
[ 279.923041] ___sys_sendmsg+0xeb/0x170
[ 279.923854] ? copy_msghdr_from_user+0x110/0x110
[ 279.924797] ? ___sys_recvmsg+0xd9/0x130
[ 279.925630] ? __perf_event_task_sched_in+0x183/0x470
[ 279.926656] ? ___sys_sendmsg+0x170/0x170
[ 279.927529] ? ctx_sched_in+0x530/0x530
[ 279.928369] ? update_curr+0x283/0x4f0
[ 279.929185] ? perf_event_update_userpage+0x570/0x570
[ 279.930201] ? __fget_light+0x57/0x520
[ 279.931023] ? __switch_to+0x53d/0xe70
[ 27
---truncated---
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于cls_api未从驱动列表中移除block_cb，可能导致释放后重用。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
二、漏洞 CVE-2023-54193 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2023-54193 的情报信息
请登录查看更多情报信息。
CVE-2023-54193 其他参考 (7)
同批安全公告 · Linux · 2025-12-30 · 共 244 条
| CVE-2023-54258 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2023-54223 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2023-54237 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2023-54257 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2023-54269 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2023-54280 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2023-54292 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2023-54184 | 9.8 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2023-54203 | 9.1 CRITICAL | Linux kernel 安全漏洞 |
| CVE-2023-54214 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-54162 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-54262 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-54318 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2022-50880 | 8.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-54250 | 8.2 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-54164 | 8.0 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-54206 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-54216 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-54210 | 7.8 HIGH | Linux kernel 安全漏洞 |
| CVE-2023-54202 | 7.8 HIGH | Linux kernel 安全漏洞 |
显示前 20 条，共 244 条。 查看全部 → →
IV. Related Vulnerabilities
V. Comments for CVE-2023-54193
暂无评论