cve-2023-52700
Vulnerability from cvelistv5
Published
2024-05-21 15:22
Modified
2024-08-02 23:11
Severity
Summary
tipc: fix kernel warning when sending SYN message
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/11a4d6f67cf55883dc78e31c247d1903ed7feccc
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/54b6082aec178f16ad6d193b4ecdc9c4823d9a32
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52700",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-18T14:38:23.667896Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-18T14:38:43.957Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:35.606Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/54b6082aec178f16ad6d193b4ecdc9c4823d9a32"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/11a4d6f67cf55883dc78e31c247d1903ed7feccc"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "54b6082aec17",
              "status": "affected",
              "version": "f25dcc7687d4",
              "versionType": "git"
            },
            {
              "lessThan": "11a4d6f67cf5",
              "status": "affected",
              "version": "f25dcc7687d4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/tipc/socket.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.0"
            },
            {
              "lessThan": "4.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.13",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntipc: fix kernel warning when sending SYN message\n\nWhen sending a SYN message, this kernel stack trace is observed:\n\n...\n[   13.396352] RIP: 0010:_copy_from_iter+0xb4/0x550\n...\n[   13.398494] Call Trace:\n[   13.398630]  \u003cTASK\u003e\n[   13.398630]  ? __alloc_skb+0xed/0x1a0\n[   13.398630]  tipc_msg_build+0x12c/0x670 [tipc]\n[   13.398630]  ? shmem_add_to_page_cache.isra.71+0x151/0x290\n[   13.398630]  __tipc_sendmsg+0x2d1/0x710 [tipc]\n[   13.398630]  ? tipc_connect+0x1d9/0x230 [tipc]\n[   13.398630]  ? __local_bh_enable_ip+0x37/0x80\n[   13.398630]  tipc_connect+0x1d9/0x230 [tipc]\n[   13.398630]  ? __sys_connect+0x9f/0xd0\n[   13.398630]  __sys_connect+0x9f/0xd0\n[   13.398630]  ? preempt_count_add+0x4d/0xa0\n[   13.398630]  ? fpregs_assert_state_consistent+0x22/0x50\n[   13.398630]  __x64_sys_connect+0x16/0x20\n[   13.398630]  do_syscall_64+0x42/0x90\n[   13.398630]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nIt is because commit a41dad905e5a (\"iov_iter: saner checks for attempt\nto copy to/from iterator\") has introduced sanity check for copying\nfrom/to iov iterator. Lacking of copy direction from the iterator\nviewpoint would lead to kernel stack trace like above.\n\nThis commit fixes this issue by initializing the iov iterator with\nthe correct copy direction when sending SYN or ACK without data."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:16:07.544Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/54b6082aec178f16ad6d193b4ecdc9c4823d9a32"
        },
        {
          "url": "https://git.kernel.org/stable/c/11a4d6f67cf55883dc78e31c247d1903ed7feccc"
        }
      ],
      "title": "tipc: fix kernel warning when sending SYN message",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52700",
    "datePublished": "2024-05-21T15:22:50.702Z",
    "dateReserved": "2024-03-07T14:49:46.891Z",
    "dateUpdated": "2024-08-02T23:11:35.606Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52700\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-21T16:15:12.480\",\"lastModified\":\"2024-05-21T16:53:56.550\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntipc: fix kernel warning when sending SYN message\\n\\nWhen sending a SYN message, this kernel stack trace is observed:\\n\\n...\\n[   13.396352] RIP: 0010:_copy_from_iter+0xb4/0x550\\n...\\n[   13.398494] Call Trace:\\n[   13.398630]  \u003cTASK\u003e\\n[   13.398630]  ? __alloc_skb+0xed/0x1a0\\n[   13.398630]  tipc_msg_build+0x12c/0x670 [tipc]\\n[   13.398630]  ? shmem_add_to_page_cache.isra.71+0x151/0x290\\n[   13.398630]  __tipc_sendmsg+0x2d1/0x710 [tipc]\\n[   13.398630]  ? tipc_connect+0x1d9/0x230 [tipc]\\n[   13.398630]  ? __local_bh_enable_ip+0x37/0x80\\n[   13.398630]  tipc_connect+0x1d9/0x230 [tipc]\\n[   13.398630]  ? __sys_connect+0x9f/0xd0\\n[   13.398630]  __sys_connect+0x9f/0xd0\\n[   13.398630]  ? preempt_count_add+0x4d/0xa0\\n[   13.398630]  ? fpregs_assert_state_consistent+0x22/0x50\\n[   13.398630]  __x64_sys_connect+0x16/0x20\\n[   13.398630]  do_syscall_64+0x42/0x90\\n[   13.398630]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\\n\\nIt is because commit a41dad905e5a (\\\"iov_iter: saner checks for attempt\\nto copy to/from iterator\\\") has introduced sanity check for copying\\nfrom/to iov iterator. Lacking of copy direction from the iterator\\nviewpoint would lead to kernel stack trace like above.\\n\\nThis commit fixes this issue by initializing the iov iterator with\\nthe correct copy direction when sending SYN or ACK without data.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tipc: corrige la advertencia del kernel al enviar un mensaje SYN Al enviar un mensaje SYN, se observa este seguimiento de la pila del kernel: ... [ 13.396352] RIP: 0010:_copy_from_iter+0xb4/0x550 . .. [ 13.398494] Seguimiento de llamadas: [ 13.398630]  [ 13.398630] ? __alloc_skb+0xed/0x1a0 [13.398630] tipc_msg_build+0x12c/0x670 [tipc] [13.398630]? shmem_add_to_page_cache.isra.71+0x151/0x290 [13.398630] __tipc_sendmsg+0x2d1/0x710 [tipc] [13.398630] ? tipc_connect+0x1d9/0x230 [tipc] [13.398630]? __local_bh_enable_ip+0x37/0x80 [13.398630] tipc_connect+0x1d9/0x230 [tipc] [13.398630]? __sys_connect+0x9f/0xd0 [ 13.398630] __sys_connect+0x9f/0xd0 [ 13.398630] ? preempt_count_add+0x4d/0xa0 [13.398630]? fpregs_assert_state_consistent+0x22/0x50 [ 13.398630] __x64_sys_connect+0x16/0x20 [ 13.398630] do_syscall_64+0x42/0x90 [ 13.398630] Entry_SYSCALL_64_after_hwframe+0x63/0xcd Es porque la confirmaci\u00f3n 41dad905e5a (\\\"iov_iter: comprobaciones m\u00e1s sensatas para intentar copiar hacia/desde el iterador\\\") ha introducido una verificaci\u00f3n de cordura para copiar desde/hacia el iterador iov. La falta de direcci\u00f3n de copia desde el punto de vista del iterador conducir\u00eda a un seguimiento de la pila del kernel como se muestra arriba. Esta confirmaci\u00f3n soluciona este problema al inicializar el iterador iov con la direcci\u00f3n de copia correcta al enviar SYN o ACK sin datos.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/11a4d6f67cf55883dc78e31c247d1903ed7feccc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/54b6082aec178f16ad6d193b4ecdc9c4823d9a32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.