CVE-2023-52487 (GCVE-0-2023-52487)

Vulnerability from cvelistv5 – Published: 2024-02-29 15:52 – Updated: 2026-05-11 19:28
VLAI
Title
net/mlx5e: Fix peer flow lists handling
Summary
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix peer flow lists handling The cited change refactored mlx5e_tc_del_fdb_peer_flow() to only clear DUP flag when list of peer flows has become empty. However, if any concurrent user holds a reference to a peer flow (for example, the neighbor update workqueue task is updating peer flow's parent encap entry concurrently), then the flow will not be removed from the peer list and, consecutively, DUP flag will remain set. Since mlx5e_tc_del_fdb_peers_flow() calls mlx5e_tc_del_fdb_peer_flow() for every possible peer index the algorithm will try to remove the flow from eswitch instances that it has never peered with causing either NULL pointer dereference when trying to remove the flow peer list head of peer_index that was never initialized or a warning if the list debug config is enabled[0]. Fix the issue by always removing the peer flow from the list even when not releasing the last reference to it. [0]: [ 3102.985806] ------------[ cut here ]------------ [ 3102.986223] list_del corruption, ffff888139110698->next is NULL [ 3102.986757] WARNING: CPU: 2 PID: 22109 at lib/list_debug.c:53 __list_del_entry_valid_or_report+0x4f/0xc0 [ 3102.987561] Modules linked in: act_ct nf_flow_table bonding act_tunnel_key act_mirred act_skbedit vxlan cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa openvswitch nsh xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcg ss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core [last unloaded: bonding] [ 3102.991113] CPU: 2 PID: 22109 Comm: revalidator28 Not tainted 6.6.0-rc6+ #3 [ 3102.991695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 3102.992605] RIP: 0010:__list_del_entry_valid_or_report+0x4f/0xc0 [ 3102.993122] Code: 39 c2 74 56 48 8b 32 48 39 fe 75 62 48 8b 51 08 48 39 f2 75 73 b8 01 00 00 00 c3 48 89 fe 48 c7 c7 48 fd 0a 82 e8 41 0b ad ff <0f> 0b 31 c0 c3 48 89 fe 48 c7 c7 70 fd 0a 82 e8 2d 0b ad ff 0f 0b [ 3102.994615] RSP: 0018:ffff8881383e7710 EFLAGS: 00010286 [ 3102.995078] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000 [ 3102.995670] RDX: 0000000000000001 RSI: ffff88885f89b640 RDI: ffff88885f89b640 [ 3102.997188] DEL flow 00000000be367878 on port 0 [ 3102.998594] RBP: dead000000000122 R08: 0000000000000000 R09: c0000000ffffdfff [ 3102.999604] R10: 0000000000000008 R11: ffff8881383e7598 R12: dead000000000100 [ 3103.000198] R13: 0000000000000002 R14: ffff888139110000 R15: ffff888101901240 [ 3103.000790] FS: 00007f424cde4700(0000) GS:ffff88885f880000(0000) knlGS:0000000000000000 [ 3103.001486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 3103.001986] CR2: 00007fd42e8dcb70 CR3: 000000011e68a003 CR4: 0000000000370ea0 [ 3103.002596] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3103.003190] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 3103.003787] Call Trace: [ 3103.004055] <TASK> [ 3103.004297] ? __warn+0x7d/0x130 [ 3103.004623] ? __list_del_entry_valid_or_report+0x4f/0xc0 [ 3103.005094] ? report_bug+0xf1/0x1c0 [ 3103.005439] ? console_unlock+0x4a/0xd0 [ 3103.005806] ? handle_bug+0x3f/0x70 [ 3103.006149] ? exc_invalid_op+0x13/0x60 [ 3103.006531] ? asm_exc_invalid_op+0x16/0x20 [ 3103.007430] ? __list_del_entry_valid_or_report+0x4f/0xc0 [ 3103.007910] mlx5e_tc_del_fdb_peers_flow+0xcf/0x240 [mlx5_core] [ 3103.008463] mlx5e_tc_del_flow+0x46/0x270 [mlx5_core] [ 3103.008944] mlx5e_flow_put+0x26/0x50 [mlx5_core] [ 3103.009401] mlx5e_delete_flower+0x25f/0x380 [mlx5_core] [ 3103.009901] tc_setup_cb_destroy+0xab/0x180 [ 3103.010292] fl_hw_destroy_filter+0x99/0xc0 [cls_flower] [ 3103.010779] __fl_delete+0x2d4/0x2f0 [cls_flower] [ 3103.0 ---truncated---
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6 , < 74cec142f89bf85c6c99c5db957da9f663f9f16f (git)
Affected: 9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6 , < e24d6f5a7f2d95a98a46257a5a5a5381d572894f (git)
Affected: 9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6 , < d76fdd31f953ac5046555171620f2562715e9b71 (git)
Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.15 , ≤ 6.6.* (semver)
Unaffected: 6.7.3 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52487",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-12T18:21:45.677555Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:24:16.635Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:19.956Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/74cec142f89bf85c6c99c5db957da9f663f9f16f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e24d6f5a7f2d95a98a46257a5a5a5381d572894f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d76fdd31f953ac5046555171620f2562715e9b71"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "74cec142f89bf85c6c99c5db957da9f663f9f16f",
              "status": "affected",
              "version": "9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6",
              "versionType": "git"
            },
            {
              "lessThan": "e24d6f5a7f2d95a98a46257a5a5a5381d572894f",
              "status": "affected",
              "version": "9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6",
              "versionType": "git"
            },
            {
              "lessThan": "d76fdd31f953ac5046555171620f2562715e9b71",
              "status": "affected",
              "version": "9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.15",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.3",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix peer flow lists handling\n\nThe cited change refactored mlx5e_tc_del_fdb_peer_flow() to only clear DUP\nflag when list of peer flows has become empty. However, if any concurrent\nuser holds a reference to a peer flow (for example, the neighbor update\nworkqueue task is updating peer flow\u0027s parent encap entry concurrently),\nthen the flow will not be removed from the peer list and, consecutively,\nDUP flag will remain set. Since mlx5e_tc_del_fdb_peers_flow() calls\nmlx5e_tc_del_fdb_peer_flow() for every possible peer index the algorithm\nwill try to remove the flow from eswitch instances that it has never peered\nwith causing either NULL pointer dereference when trying to remove the flow\npeer list head of peer_index that was never initialized or a warning if the\nlist debug config is enabled[0].\n\nFix the issue by always removing the peer flow from the list even when not\nreleasing the last reference to it.\n\n[0]:\n\n[ 3102.985806] ------------[ cut here ]------------\n[ 3102.986223] list_del corruption, ffff888139110698-\u003enext is NULL\n[ 3102.986757] WARNING: CPU: 2 PID: 22109 at lib/list_debug.c:53 __list_del_entry_valid_or_report+0x4f/0xc0\n[ 3102.987561] Modules linked in: act_ct nf_flow_table bonding act_tunnel_key act_mirred act_skbedit vxlan cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa openvswitch nsh xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcg\nss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core [last unloaded: bonding]\n[ 3102.991113] CPU: 2 PID: 22109 Comm: revalidator28 Not tainted 6.6.0-rc6+ #3\n[ 3102.991695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n[ 3102.992605] RIP: 0010:__list_del_entry_valid_or_report+0x4f/0xc0\n[ 3102.993122] Code: 39 c2 74 56 48 8b 32 48 39 fe 75 62 48 8b 51 08 48 39 f2 75 73 b8 01 00 00 00 c3 48 89 fe 48 c7 c7 48 fd 0a 82 e8 41 0b ad ff \u003c0f\u003e 0b 31 c0 c3 48 89 fe 48 c7 c7 70 fd 0a 82 e8 2d 0b ad ff 0f 0b\n[ 3102.994615] RSP: 0018:ffff8881383e7710 EFLAGS: 00010286\n[ 3102.995078] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000\n[ 3102.995670] RDX: 0000000000000001 RSI: ffff88885f89b640 RDI: ffff88885f89b640\n[ 3102.997188] DEL flow 00000000be367878 on port 0\n[ 3102.998594] RBP: dead000000000122 R08: 0000000000000000 R09: c0000000ffffdfff\n[ 3102.999604] R10: 0000000000000008 R11: ffff8881383e7598 R12: dead000000000100\n[ 3103.000198] R13: 0000000000000002 R14: ffff888139110000 R15: ffff888101901240\n[ 3103.000790] FS:  00007f424cde4700(0000) GS:ffff88885f880000(0000) knlGS:0000000000000000\n[ 3103.001486] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 3103.001986] CR2: 00007fd42e8dcb70 CR3: 000000011e68a003 CR4: 0000000000370ea0\n[ 3103.002596] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[ 3103.003190] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[ 3103.003787] Call Trace:\n[ 3103.004055]  \u003cTASK\u003e\n[ 3103.004297]  ? __warn+0x7d/0x130\n[ 3103.004623]  ? __list_del_entry_valid_or_report+0x4f/0xc0\n[ 3103.005094]  ? report_bug+0xf1/0x1c0\n[ 3103.005439]  ? console_unlock+0x4a/0xd0\n[ 3103.005806]  ? handle_bug+0x3f/0x70\n[ 3103.006149]  ? exc_invalid_op+0x13/0x60\n[ 3103.006531]  ? asm_exc_invalid_op+0x16/0x20\n[ 3103.007430]  ? __list_del_entry_valid_or_report+0x4f/0xc0\n[ 3103.007910]  mlx5e_tc_del_fdb_peers_flow+0xcf/0x240 [mlx5_core]\n[ 3103.008463]  mlx5e_tc_del_flow+0x46/0x270 [mlx5_core]\n[ 3103.008944]  mlx5e_flow_put+0x26/0x50 [mlx5_core]\n[ 3103.009401]  mlx5e_delete_flower+0x25f/0x380 [mlx5_core]\n[ 3103.009901]  tc_setup_cb_destroy+0xab/0x180\n[ 3103.010292]  fl_hw_destroy_filter+0x99/0xc0 [cls_flower]\n[ 3103.010779]  __fl_delete+0x2d4/0x2f0 [cls_flower]\n[ 3103.0\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:28:16.987Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/74cec142f89bf85c6c99c5db957da9f663f9f16f"
        },
        {
          "url": "https://git.kernel.org/stable/c/e24d6f5a7f2d95a98a46257a5a5a5381d572894f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d76fdd31f953ac5046555171620f2562715e9b71"
        }
      ],
      "title": "net/mlx5e: Fix peer flow lists handling",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52487",
    "datePublished": "2024-02-29T15:52:07.507Z",
    "dateReserved": "2024-02-20T12:30:33.301Z",
    "dateUpdated": "2026-05-11T19:28:16.987Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52487",
      "date": "2026-07-14",
      "epss": "0.00272",
      "percentile": "0.19023"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.5\", \"versionEndExcluding\": \"6.6.15\", \"matchCriteriaId\": \"07EC9AC4-078E-4968-A31E-3F2E7BD842B1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.7.3\", \"matchCriteriaId\": \"58FD5308-148A-40D3-B36A-0CA6B434A8BF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"B9F4EA73-0894-400F-A490-3A397AB7A517\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: Fix peer flow lists handling\\n\\nThe cited change refactored mlx5e_tc_del_fdb_peer_flow() to only clear DUP\\nflag when list of peer flows has become empty. However, if any concurrent\\nuser holds a reference to a peer flow (for example, the neighbor update\\nworkqueue task is updating peer flow\u0027s parent encap entry concurrently),\\nthen the flow will not be removed from the peer list and, consecutively,\\nDUP flag will remain set. Since mlx5e_tc_del_fdb_peers_flow() calls\\nmlx5e_tc_del_fdb_peer_flow() for every possible peer index the algorithm\\nwill try to remove the flow from eswitch instances that it has never peered\\nwith causing either NULL pointer dereference when trying to remove the flow\\npeer list head of peer_index that was never initialized or a warning if the\\nlist debug config is enabled[0].\\n\\nFix the issue by always removing the peer flow from the list even when not\\nreleasing the last reference to it.\\n\\n[0]:\\n\\n[ 3102.985806] ------------[ cut here ]------------\\n[ 3102.986223] list_del corruption, ffff888139110698-\u003enext is NULL\\n[ 3102.986757] WARNING: CPU: 2 PID: 22109 at lib/list_debug.c:53 __list_del_entry_valid_or_report+0x4f/0xc0\\n[ 3102.987561] Modules linked in: act_ct nf_flow_table bonding act_tunnel_key act_mirred act_skbedit vxlan cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa openvswitch nsh xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcg\\nss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core [last unloaded: bonding]\\n[ 3102.991113] CPU: 2 PID: 22109 Comm: revalidator28 Not tainted 6.6.0-rc6+ #3\\n[ 3102.991695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\n[ 3102.992605] RIP: 0010:__list_del_entry_valid_or_report+0x4f/0xc0\\n[ 3102.993122] Code: 39 c2 74 56 48 8b 32 48 39 fe 75 62 48 8b 51 08 48 39 f2 75 73 b8 01 00 00 00 c3 48 89 fe 48 c7 c7 48 fd 0a 82 e8 41 0b ad ff \u003c0f\u003e 0b 31 c0 c3 48 89 fe 48 c7 c7 70 fd 0a 82 e8 2d 0b ad ff 0f 0b\\n[ 3102.994615] RSP: 0018:ffff8881383e7710 EFLAGS: 00010286\\n[ 3102.995078] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000\\n[ 3102.995670] RDX: 0000000000000001 RSI: ffff88885f89b640 RDI: ffff88885f89b640\\n[ 3102.997188] DEL flow 00000000be367878 on port 0\\n[ 3102.998594] RBP: dead000000000122 R08: 0000000000000000 R09: c0000000ffffdfff\\n[ 3102.999604] R10: 0000000000000008 R11: ffff8881383e7598 R12: dead000000000100\\n[ 3103.000198] R13: 0000000000000002 R14: ffff888139110000 R15: ffff888101901240\\n[ 3103.000790] FS:  00007f424cde4700(0000) GS:ffff88885f880000(0000) knlGS:0000000000000000\\n[ 3103.001486] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[ 3103.001986] CR2: 00007fd42e8dcb70 CR3: 000000011e68a003 CR4: 0000000000370ea0\\n[ 3103.002596] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n[ 3103.003190] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n[ 3103.003787] Call Trace:\\n[ 3103.004055]  \u003cTASK\u003e\\n[ 3103.004297]  ? __warn+0x7d/0x130\\n[ 3103.004623]  ? __list_del_entry_valid_or_report+0x4f/0xc0\\n[ 3103.005094]  ? report_bug+0xf1/0x1c0\\n[ 3103.005439]  ? console_unlock+0x4a/0xd0\\n[ 3103.005806]  ? handle_bug+0x3f/0x70\\n[ 3103.006149]  ? exc_invalid_op+0x13/0x60\\n[ 3103.006531]  ? asm_exc_invalid_op+0x16/0x20\\n[ 3103.007430]  ? __list_del_entry_valid_or_report+0x4f/0xc0\\n[ 3103.007910]  mlx5e_tc_del_fdb_peers_flow+0xcf/0x240 [mlx5_core]\\n[ 3103.008463]  mlx5e_tc_del_flow+0x46/0x270 [mlx5_core]\\n[ 3103.008944]  mlx5e_flow_put+0x26/0x50 [mlx5_core]\\n[ 3103.009401]  mlx5e_delete_flower+0x25f/0x380 [mlx5_core]\\n[ 3103.009901]  tc_setup_cb_destroy+0xab/0x180\\n[ 3103.010292]  fl_hw_destroy_filter+0x99/0xc0 [cls_flower]\\n[ 3103.010779]  __fl_delete+0x2d4/0x2f0 [cls_flower]\\n[ 3103.0\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: net/mlx5e: corrigi\\u00f3 el manejo de listas de flujos de pares. El cambio citado refactoriz\\u00f3 mlx5e_tc_del_fdb_peer_flow() para borrar solo el indicador DUP cuando la lista de flujos de pares qued\\u00f3 vac\\u00eda. Sin embargo, si alg\\u00fan usuario simult\\u00e1neo tiene una referencia a un flujo de pares (por ejemplo, la tarea de actualizaci\\u00f3n de la cola de trabajo del vecino est\\u00e1 actualizando la entrada de encapsulaci\\u00f3n principal del flujo de pares simult\\u00e1neamente), entonces el flujo no se eliminar\\u00e1 de la lista de pares y, consecutivamente, se activar\\u00e1 el indicador DUP. permanecer configurado. Dado que mlx5e_tc_del_fdb_peers_flow() llama a mlx5e_tc_del_fdb_peer_flow() para cada \\u00edndice de pares posible, el algoritmo intentar\\u00e1 eliminar el flujo de las instancias de eswitch con las que nunca ha emparejado, lo que provocar\\u00e1 una desreferencia del puntero NULL al intentar eliminar el encabezado de la lista de pares de flujo de peer_index que nunca se inicializ\\u00f3. o una advertencia si la configuraci\\u00f3n de depuraci\\u00f3n de la lista est\\u00e1 habilitada [0]. Solucione el problema eliminando siempre el flujo de pares de la lista, incluso cuando no publique la \\u00faltima referencia al mismo. [0]: [3102.985806] ------------[ cortar aqu\\u00ed ]------------ [ 3102.986223] list_del corrupci\\u00f3n, ffff888139110698-\u0026gt;el siguiente es NULL [ 3102.986757] ADVERTENCIA: CPU: 2 PID: 22109 en lib/list_debug.c:53 __list_del_entry_valid_or_report+0x4f/0xc0 [3102.987561] M\\u00f3dulos vinculados en: act_ct nf_flow_table bonding act_tunnel_key act_mirred act_skbedit vxlan cls_matchall nfnetlink_cttimeout act_gact cl s_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa openvswitch nsh xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcg ss oid_registry superposici\\u00f3n rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5 _core [\\u00faltima descarga: uni\\u00f3n] [3102.991113] CPU: 2 PID: 22109 Comm: revalidator28 No contaminado 6.6.0-rc6+ #3 [ 3102.991695] Nombre del hardware: PC est\\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 01/04/2014 [ 3102.992605] RIP: 0010:__list_del_entry_valid_or_report+0x4 f/0xc0 [ 3102.993122] C\\u00f3digo: 39 c2 74 56 48 8b 32 48 39 fe 75 62 48 8b 51 08 48 39 f2 75 73 b8 01 00 00 00 c3 48 89 fe 48 c7 c7 48 fd 0a 82 e8 41 0b anuncio ff \u0026lt;0f\u0026gt; 0b 31 c0 c3 48 89 fe 48 c7 c7 70 fd 0a 82 e8 2d 0b ad ff 0f 0b [ 3102.994615] RSP: 0018:ffff8881383e7710 EFLAGS: 00010286 [ 3102.995078] RAX: 000 0000000000000 RBX: 0000000000000002 RCX: 0000000000000000 [ 3102.995670] RDX: 0000000000000001 RSI: ffff88885f89b640 RDI: ffff88885f89b640 [ 3102.997188] Flujo DEL 00000000be367878 en el puerto 0 [ 3102.998594] RBP: dead000000000122 R08: 00000000000000000 R 09: c0000000ffffdfff [ 3102.999604] R10: 0000000000000008 R11: ffff8881383e7598 R12: muerto000000000100 [ 3103.000198] R13: 0000000000000002 R14 :ffff888139110000 R15: ffff888101901240 [ 3103.000790] FS: 00007f424cde4700(0000) GS:ffff88885f880000(0000) knlGS:00000000000000000 [ 3103.001486] CS: 0010 DS: 000 0 ES: 0000 CR0: 0000000080050033 [ 3103.001986] CR2: 00007fd42e8dcb70 CR3: 000000011e68a003 CR4: 0000000000370ea0 [ 3103.002596] DR0 : 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3103.003190] DR3: 0000000000000000 DR6: 00000000ffe0ff0 DR7: 00000000000 00400 [ 3103.003787] Seguimiento de llamadas: [ 3103.004055]  [ 3103.004297] ? __advertir+0x7d/0x130 [ 3103.004623] ? __list_del_entry_valid_or_report+0x4f/0xc0 [3103.005094] ? report_bug+0xf1/0x1c0 [3103.005439]? console_unlock+0x4a/0xd0 [3103.005806]? handle_bug+0x3f/0x70 [3103.006149]? exc_invalid_op+0x13/0x60 [3103.006531]? asm_exc_invalid_op+0x16/0x20 [3103.007430]? __list_del_entry_valid_or_report+0x4f/0xc0 [3103.007910] mlx5e_tc_del_fdb_peers_flow+0xcf/0x240 [mlx5_core] [3103.008463] mlx5e_tc_del_flow+0x46/0x270 truncado\"}]",
      "id": "CVE-2023-52487",
      "lastModified": "2024-12-12T17:31:37.627",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-03-11T18:15:16.520",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/74cec142f89bf85c6c99c5db957da9f663f9f16f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d76fdd31f953ac5046555171620f2562715e9b71\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e24d6f5a7f2d95a98a46257a5a5a5381d572894f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/74cec142f89bf85c6c99c5db957da9f663f9f16f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d76fdd31f953ac5046555171620f2562715e9b71\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/e24d6f5a7f2d95a98a46257a5a5a5381d572894f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52487\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-03-11T18:15:16.520\",\"lastModified\":\"2026-06-17T06:42:50.393\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: Fix peer flow lists handling\\n\\nThe cited change refactored mlx5e_tc_del_fdb_peer_flow() to only clear DUP\\nflag when list of peer flows has become empty. However, if any concurrent\\nuser holds a reference to a peer flow (for example, the neighbor update\\nworkqueue task is updating peer flow\u0027s parent encap entry concurrently),\\nthen the flow will not be removed from the peer list and, consecutively,\\nDUP flag will remain set. Since mlx5e_tc_del_fdb_peers_flow() calls\\nmlx5e_tc_del_fdb_peer_flow() for every possible peer index the algorithm\\nwill try to remove the flow from eswitch instances that it has never peered\\nwith causing either NULL pointer dereference when trying to remove the flow\\npeer list head of peer_index that was never initialized or a warning if the\\nlist debug config is enabled[0].\\n\\nFix the issue by always removing the peer flow from the list even when not\\nreleasing the last reference to it.\\n\\n[0]:\\n\\n[ 3102.985806] ------------[ cut here ]------------\\n[ 3102.986223] list_del corruption, ffff888139110698-\u003enext is NULL\\n[ 3102.986757] WARNING: CPU: 2 PID: 22109 at lib/list_debug.c:53 __list_del_entry_valid_or_report+0x4f/0xc0\\n[ 3102.987561] Modules linked in: act_ct nf_flow_table bonding act_tunnel_key act_mirred act_skbedit vxlan cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa openvswitch nsh xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcg\\nss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core [last unloaded: bonding]\\n[ 3102.991113] CPU: 2 PID: 22109 Comm: revalidator28 Not tainted 6.6.0-rc6+ #3\\n[ 3102.991695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\n[ 3102.992605] RIP: 0010:__list_del_entry_valid_or_report+0x4f/0xc0\\n[ 3102.993122] Code: 39 c2 74 56 48 8b 32 48 39 fe 75 62 48 8b 51 08 48 39 f2 75 73 b8 01 00 00 00 c3 48 89 fe 48 c7 c7 48 fd 0a 82 e8 41 0b ad ff \u003c0f\u003e 0b 31 c0 c3 48 89 fe 48 c7 c7 70 fd 0a 82 e8 2d 0b ad ff 0f 0b\\n[ 3102.994615] RSP: 0018:ffff8881383e7710 EFLAGS: 00010286\\n[ 3102.995078] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000\\n[ 3102.995670] RDX: 0000000000000001 RSI: ffff88885f89b640 RDI: ffff88885f89b640\\n[ 3102.997188] DEL flow 00000000be367878 on port 0\\n[ 3102.998594] RBP: dead000000000122 R08: 0000000000000000 R09: c0000000ffffdfff\\n[ 3102.999604] R10: 0000000000000008 R11: ffff8881383e7598 R12: dead000000000100\\n[ 3103.000198] R13: 0000000000000002 R14: ffff888139110000 R15: ffff888101901240\\n[ 3103.000790] FS:  00007f424cde4700(0000) GS:ffff88885f880000(0000) knlGS:0000000000000000\\n[ 3103.001486] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[ 3103.001986] CR2: 00007fd42e8dcb70 CR3: 000000011e68a003 CR4: 0000000000370ea0\\n[ 3103.002596] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n[ 3103.003190] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n[ 3103.003787] Call Trace:\\n[ 3103.004055]  \u003cTASK\u003e\\n[ 3103.004297]  ? __warn+0x7d/0x130\\n[ 3103.004623]  ? __list_del_entry_valid_or_report+0x4f/0xc0\\n[ 3103.005094]  ? report_bug+0xf1/0x1c0\\n[ 3103.005439]  ? console_unlock+0x4a/0xd0\\n[ 3103.005806]  ? handle_bug+0x3f/0x70\\n[ 3103.006149]  ? exc_invalid_op+0x13/0x60\\n[ 3103.006531]  ? asm_exc_invalid_op+0x16/0x20\\n[ 3103.007430]  ? __list_del_entry_valid_or_report+0x4f/0xc0\\n[ 3103.007910]  mlx5e_tc_del_fdb_peers_flow+0xcf/0x240 [mlx5_core]\\n[ 3103.008463]  mlx5e_tc_del_flow+0x46/0x270 [mlx5_core]\\n[ 3103.008944]  mlx5e_flow_put+0x26/0x50 [mlx5_core]\\n[ 3103.009401]  mlx5e_delete_flower+0x25f/0x380 [mlx5_core]\\n[ 3103.009901]  tc_setup_cb_destroy+0xab/0x180\\n[ 3103.010292]  fl_hw_destroy_filter+0x99/0xc0 [cls_flower]\\n[ 3103.010779]  __fl_delete+0x2d4/0x2f0 [cls_flower]\\n[ 3103.0\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: net/mlx5e: corrigi\u00f3 el manejo de listas de flujos de pares. El cambio citado refactoriz\u00f3 mlx5e_tc_del_fdb_peer_flow() para borrar solo el indicador DUP cuando la lista de flujos de pares qued\u00f3 vac\u00eda. Sin embargo, si alg\u00fan usuario simult\u00e1neo tiene una referencia a un flujo de pares (por ejemplo, la tarea de actualizaci\u00f3n de la cola de trabajo del vecino est\u00e1 actualizando la entrada de encapsulaci\u00f3n principal del flujo de pares simult\u00e1neamente), entonces el flujo no se eliminar\u00e1 de la lista de pares y, consecutivamente, se activar\u00e1 el indicador DUP. permanecer configurado. Dado que mlx5e_tc_del_fdb_peers_flow() llama a mlx5e_tc_del_fdb_peer_flow() para cada \u00edndice de pares posible, el algoritmo intentar\u00e1 eliminar el flujo de las instancias de eswitch con las que nunca ha emparejado, lo que provocar\u00e1 una desreferencia del puntero NULL al intentar eliminar el encabezado de la lista de pares de flujo de peer_index que nunca se inicializ\u00f3. o una advertencia si la configuraci\u00f3n de depuraci\u00f3n de la lista est\u00e1 habilitada [0]. Solucione el problema eliminando siempre el flujo de pares de la lista, incluso cuando no publique la \u00faltima referencia al mismo. [0]: [3102.985806] ------------[ cortar aqu\u00ed ]------------ [ 3102.986223] list_del corrupci\u00f3n, ffff888139110698-\u0026gt;el siguiente es NULL [ 3102.986757] ADVERTENCIA: CPU: 2 PID: 22109 en lib/list_debug.c:53 __list_del_entry_valid_or_report+0x4f/0xc0 [3102.987561] M\u00f3dulos vinculados en: act_ct nf_flow_table bonding act_tunnel_key act_mirred act_skbedit vxlan cls_matchall nfnetlink_cttimeout act_gact cl s_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa openvswitch nsh xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcg ss oid_registry superposici\u00f3n rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5 _core [\u00faltima descarga: uni\u00f3n] [3102.991113] CPU: 2 PID: 22109 Comm: revalidator28 No contaminado 6.6.0-rc6+ #3 [ 3102.991695] Nombre del hardware: PC est\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 01/04/2014 [ 3102.992605] RIP: 0010:__list_del_entry_valid_or_report+0x4 f/0xc0 [ 3102.993122] C\u00f3digo: 39 c2 74 56 48 8b 32 48 39 fe 75 62 48 8b 51 08 48 39 f2 75 73 b8 01 00 00 00 c3 48 89 fe 48 c7 c7 48 fd 0a 82 e8 41 0b anuncio ff \u0026lt;0f\u0026gt; 0b 31 c0 c3 48 89 fe 48 c7 c7 70 fd 0a 82 e8 2d 0b ad ff 0f 0b [ 3102.994615] RSP: 0018:ffff8881383e7710 EFLAGS: 00010286 [ 3102.995078] RAX: 000 0000000000000 RBX: 0000000000000002 RCX: 0000000000000000 [ 3102.995670] RDX: 0000000000000001 RSI: ffff88885f89b640 RDI: ffff88885f89b640 [ 3102.997188] Flujo DEL 00000000be367878 en el puerto 0 [ 3102.998594] RBP: dead000000000122 R08: 00000000000000000 R 09: c0000000ffffdfff [ 3102.999604] R10: 0000000000000008 R11: ffff8881383e7598 R12: muerto000000000100 [ 3103.000198] R13: 0000000000000002 R14 :ffff888139110000 R15: ffff888101901240 [ 3103.000790] FS: 00007f424cde4700(0000) GS:ffff88885f880000(0000) knlGS:00000000000000000 [ 3103.001486] CS: 0010 DS: 000 0 ES: 0000 CR0: 0000000080050033 [ 3103.001986] CR2: 00007fd42e8dcb70 CR3: 000000011e68a003 CR4: 0000000000370ea0 [ 3103.002596] DR0 : 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 3103.003190] DR3: 0000000000000000 DR6: 00000000ffe0ff0 DR7: 00000000000 00400 [ 3103.003787] Seguimiento de llamadas: [ 3103.004055]  [ 3103.004297] ? __advertir+0x7d/0x130 [ 3103.004623] ? __list_del_entry_valid_or_report+0x4f/0xc0 [3103.005094] ? report_bug+0xf1/0x1c0 [3103.005439]? console_unlock+0x4a/0xd0 [3103.005806]? handle_bug+0x3f/0x70 [3103.006149]? exc_invalid_op+0x13/0x60 [3103.006531]? asm_exc_invalid_op+0x16/0x20 [3103.007430]? __list_del_entry_valid_or_report+0x4f/0xc0 [3103.007910] mlx5e_tc_del_fdb_peers_flow+0xcf/0x240 [mlx5_core] [3103.008463] mlx5e_tc_del_flow+0x46/0x270 truncado\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en_tc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6\",\"lessThan\":\"74cec142f89bf85c6c99c5db957da9f663f9f16f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6\",\"lessThan\":\"e24d6f5a7f2d95a98a46257a5a5a5381d572894f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6\",\"lessThan\":\"d76fdd31f953ac5046555171620f2562715e9b71\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/mellanox/mlx5/core/en_tc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.15\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.3\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-03-12T18:21:45.677555Z\",\"id\":\"CVE-2023-52487\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.15\",\"matchCriteriaId\":\"07EC9AC4-078E-4968-A31E-3F2E7BD842B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.3\",\"matchCriteriaId\":\"58FD5308-148A-40D3-B36A-0CA6B434A8BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/74cec142f89bf85c6c99c5db957da9f663f9f16f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d76fdd31f953ac5046555171620f2562715e9b71\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e24d6f5a7f2d95a98a46257a5a5a5381d572894f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/74cec142f89bf85c6c99c5db957da9f663f9f16f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d76fdd31f953ac5046555171620f2562715e9b71\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e24d6f5a7f2d95a98a46257a5a5a5381d572894f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T11:06:28+00:00",
      "cve": "CVE-2023-52487",
      "id": "CVE-2023-52487",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_affected": "150",
      "product_status:known_not_affected": "48",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/mlx5e: Fix peer flow lists handling",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52487.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/74cec142f89bf85c6c99c5db957da9f663f9f16f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e24d6f5a7f2d95a98a46257a5a5a5381d572894f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d76fdd31f953ac5046555171620f2562715e9b71\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:03:19.956Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52487\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-03-12T18:21:45.677555Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:17.136Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"net/mlx5e: Fix peer flow lists handling\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6\", \"lessThan\": \"74cec142f89bf85c6c99c5db957da9f663f9f16f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6\", \"lessThan\": \"e24d6f5a7f2d95a98a46257a5a5a5381d572894f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"9be6c21fdcf8a7ec48262bb76f78c17ac2761ac6\", \"lessThan\": \"d76fdd31f953ac5046555171620f2562715e9b71\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en_tc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.15\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/mellanox/mlx5/core/en_tc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/74cec142f89bf85c6c99c5db957da9f663f9f16f\"}, {\"url\": \"https://git.kernel.org/stable/c/e24d6f5a7f2d95a98a46257a5a5a5381d572894f\"}, {\"url\": \"https://git.kernel.org/stable/c/d76fdd31f953ac5046555171620f2562715e9b71\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/mlx5e: Fix peer flow lists handling\\n\\nThe cited change refactored mlx5e_tc_del_fdb_peer_flow() to only clear DUP\\nflag when list of peer flows has become empty. However, if any concurrent\\nuser holds a reference to a peer flow (for example, the neighbor update\\nworkqueue task is updating peer flow\u0027s parent encap entry concurrently),\\nthen the flow will not be removed from the peer list and, consecutively,\\nDUP flag will remain set. Since mlx5e_tc_del_fdb_peers_flow() calls\\nmlx5e_tc_del_fdb_peer_flow() for every possible peer index the algorithm\\nwill try to remove the flow from eswitch instances that it has never peered\\nwith causing either NULL pointer dereference when trying to remove the flow\\npeer list head of peer_index that was never initialized or a warning if the\\nlist debug config is enabled[0].\\n\\nFix the issue by always removing the peer flow from the list even when not\\nreleasing the last reference to it.\\n\\n[0]:\\n\\n[ 3102.985806] ------------[ cut here ]------------\\n[ 3102.986223] list_del corruption, ffff888139110698-\u003enext is NULL\\n[ 3102.986757] WARNING: CPU: 2 PID: 22109 at lib/list_debug.c:53 __list_del_entry_valid_or_report+0x4f/0xc0\\n[ 3102.987561] Modules linked in: act_ct nf_flow_table bonding act_tunnel_key act_mirred act_skbedit vxlan cls_matchall nfnetlink_cttimeout act_gact cls_flower sch_ingress mlx5_vdpa vringh vhost_iotlb vdpa openvswitch nsh xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcg\\nss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core mlx5_core [last unloaded: bonding]\\n[ 3102.991113] CPU: 2 PID: 22109 Comm: revalidator28 Not tainted 6.6.0-rc6+ #3\\n[ 3102.991695] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\n[ 3102.992605] RIP: 0010:__list_del_entry_valid_or_report+0x4f/0xc0\\n[ 3102.993122] Code: 39 c2 74 56 48 8b 32 48 39 fe 75 62 48 8b 51 08 48 39 f2 75 73 b8 01 00 00 00 c3 48 89 fe 48 c7 c7 48 fd 0a 82 e8 41 0b ad ff \u003c0f\u003e 0b 31 c0 c3 48 89 fe 48 c7 c7 70 fd 0a 82 e8 2d 0b ad ff 0f 0b\\n[ 3102.994615] RSP: 0018:ffff8881383e7710 EFLAGS: 00010286\\n[ 3102.995078] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000\\n[ 3102.995670] RDX: 0000000000000001 RSI: ffff88885f89b640 RDI: ffff88885f89b640\\n[ 3102.997188] DEL flow 00000000be367878 on port 0\\n[ 3102.998594] RBP: dead000000000122 R08: 0000000000000000 R09: c0000000ffffdfff\\n[ 3102.999604] R10: 0000000000000008 R11: ffff8881383e7598 R12: dead000000000100\\n[ 3103.000198] R13: 0000000000000002 R14: ffff888139110000 R15: ffff888101901240\\n[ 3103.000790] FS:  00007f424cde4700(0000) GS:ffff88885f880000(0000) knlGS:0000000000000000\\n[ 3103.001486] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n[ 3103.001986] CR2: 00007fd42e8dcb70 CR3: 000000011e68a003 CR4: 0000000000370ea0\\n[ 3103.002596] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n[ 3103.003190] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n[ 3103.003787] Call Trace:\\n[ 3103.004055]  \u003cTASK\u003e\\n[ 3103.004297]  ? __warn+0x7d/0x130\\n[ 3103.004623]  ? __list_del_entry_valid_or_report+0x4f/0xc0\\n[ 3103.005094]  ? report_bug+0xf1/0x1c0\\n[ 3103.005439]  ? console_unlock+0x4a/0xd0\\n[ 3103.005806]  ? handle_bug+0x3f/0x70\\n[ 3103.006149]  ? exc_invalid_op+0x13/0x60\\n[ 3103.006531]  ? asm_exc_invalid_op+0x16/0x20\\n[ 3103.007430]  ? __list_del_entry_valid_or_report+0x4f/0xc0\\n[ 3103.007910]  mlx5e_tc_del_fdb_peers_flow+0xcf/0x240 [mlx5_core]\\n[ 3103.008463]  mlx5e_tc_del_flow+0x46/0x270 [mlx5_core]\\n[ 3103.008944]  mlx5e_flow_put+0x26/0x50 [mlx5_core]\\n[ 3103.009401]  mlx5e_delete_flower+0x25f/0x380 [mlx5_core]\\n[ 3103.009901]  tc_setup_cb_destroy+0xab/0x180\\n[ 3103.010292]  fl_hw_destroy_filter+0x99/0xc0 [cls_flower]\\n[ 3103.010779]  __fl_delete+0x2d4/0x2f0 [cls_flower]\\n[ 3103.0\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.15\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.3\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T19:28:16.987Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52487\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T19:28:16.987Z\", \"dateReserved\": \"2024-02-20T12:30:33.301Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-02-29T15:52:07.507Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.