CVE-2023-53752 (GCVE-0-2023-53752)
Vulnerability from cvelistv5
Published
2025-12-08 01:19
Modified
2025-12-08 01:19
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: deal with integer overflows in kmalloc_reserve()
Blamed commit changed:
ptr = kmalloc(size);
if (ptr)
size = ksize(ptr);
size = kmalloc_size_roundup(size);
ptr = kmalloc(size);
This allowed various crash as reported by syzbot [1]
and Kyle Zeng.
Problem is that if @size is bigger than 0x80000001,
kmalloc_size_roundup(size) returns 2^32.
kmalloc_reserve() uses a 32bit variable (obj_size),
so 2^32 is truncated to 0.
kmalloc(0) returns ZERO_SIZE_PTR which is not handled by
skb allocations.
Following trace can be triggered if a netdev->mtu is set
close to 0x7fffffff
We might in the future limit netdev->mtu to more sensible
limit (like KMALLOC_MAX_SIZE).
This patch is based on a syzbot report, and also a report
and tentative fix from Kyle Zeng.
[1]
BUG: KASAN: user-memory-access in __build_skb_around net/core/skbuff.c:294 [inline]
BUG: KASAN: user-memory-access in __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527
Write of size 32 at addr 00000000fffffd10 by task syz-executor.4/22554
CPU: 1 PID: 22554 Comm: syz-executor.4 Not tainted 6.1.39-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:279
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:286
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x120/0x1a0 lib/dump_stack.c:106
print_report+0xe4/0x4b4 mm/kasan/report.c:398
kasan_report+0x150/0x1ac mm/kasan/report.c:495
kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189
memset+0x40/0x70 mm/kasan/shadow.c:44
__build_skb_around net/core/skbuff.c:294 [inline]
__alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527
alloc_skb include/linux/skbuff.h:1316 [inline]
igmpv3_newpack+0x104/0x1088 net/ipv4/igmp.c:359
add_grec+0x81c/0x1124 net/ipv4/igmp.c:534
igmpv3_send_cr net/ipv4/igmp.c:667 [inline]
igmp_ifc_timer_expire+0x1b0/0x1008 net/ipv4/igmp.c:810
call_timer_fn+0x1c0/0x9f0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers+0x54c/0x710 kernel/time/timer.c:1790
run_timer_softirq+0x28/0x4c kernel/time/timer.c:1803
_stext+0x380/0xfbc
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79
call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:891
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84
invoke_softirq kernel/softirq.c:437 [inline]
__irq_exit_rcu+0x1c0/0x4cc kernel/softirq.c:683
irq_exit_rcu+0x14/0x78 kernel/softirq.c:695
el0_interrupt+0x7c/0x2e0 arch/arm64/kernel/entry-common.c:717
__el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724
el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729
el0t_64_irq+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/skbuff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "31cf7853a940181593e4472fc56f46574123f9f6",
"status": "affected",
"version": "0dbc898f5917c5a3bec6be19d9f5469cbc351a7d",
"versionType": "git"
},
{
"lessThan": "e4ffc47a1c3e5d11a853aa178c9a5136e79412e9",
"status": "affected",
"version": "12d6c1d3a2ad0c199ec57c201cdc71e8e157a232",
"versionType": "git"
},
{
"lessThan": "bf7da02d2b8faf324206e1cbe64a4813ff903cc1",
"status": "affected",
"version": "12d6c1d3a2ad0c199ec57c201cdc71e8e157a232",
"versionType": "git"
},
{
"lessThan": "915d975b2ffa58a14bfcf16fafe00c41315949ff",
"status": "affected",
"version": "12d6c1d3a2ad0c199ec57c201cdc71e8e157a232",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/skbuff.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.54",
"versionStartIncluding": "6.1.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.16",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.3",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: deal with integer overflows in kmalloc_reserve()\n\nBlamed commit changed:\n ptr = kmalloc(size);\n if (ptr)\n size = ksize(ptr);\n\n size = kmalloc_size_roundup(size);\n ptr = kmalloc(size);\n\nThis allowed various crash as reported by syzbot [1]\nand Kyle Zeng.\n\nProblem is that if @size is bigger than 0x80000001,\nkmalloc_size_roundup(size) returns 2^32.\n\nkmalloc_reserve() uses a 32bit variable (obj_size),\nso 2^32 is truncated to 0.\n\nkmalloc(0) returns ZERO_SIZE_PTR which is not handled by\nskb allocations.\n\nFollowing trace can be triggered if a netdev-\u003emtu is set\nclose to 0x7fffffff\n\nWe might in the future limit netdev-\u003emtu to more sensible\nlimit (like KMALLOC_MAX_SIZE).\n\nThis patch is based on a syzbot report, and also a report\nand tentative fix from Kyle Zeng.\n\n[1]\nBUG: KASAN: user-memory-access in __build_skb_around net/core/skbuff.c:294 [inline]\nBUG: KASAN: user-memory-access in __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527\nWrite of size 32 at addr 00000000fffffd10 by task syz-executor.4/22554\n\nCPU: 1 PID: 22554 Comm: syz-executor.4 Not tainted 6.1.39-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023\nCall trace:\ndump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:279\nshow_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:286\n__dump_stack lib/dump_stack.c:88 [inline]\ndump_stack_lvl+0x120/0x1a0 lib/dump_stack.c:106\nprint_report+0xe4/0x4b4 mm/kasan/report.c:398\nkasan_report+0x150/0x1ac mm/kasan/report.c:495\nkasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189\nmemset+0x40/0x70 mm/kasan/shadow.c:44\n__build_skb_around net/core/skbuff.c:294 [inline]\n__alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527\nalloc_skb include/linux/skbuff.h:1316 [inline]\nigmpv3_newpack+0x104/0x1088 net/ipv4/igmp.c:359\nadd_grec+0x81c/0x1124 net/ipv4/igmp.c:534\nigmpv3_send_cr net/ipv4/igmp.c:667 [inline]\nigmp_ifc_timer_expire+0x1b0/0x1008 net/ipv4/igmp.c:810\ncall_timer_fn+0x1c0/0x9f0 kernel/time/timer.c:1474\nexpire_timers kernel/time/timer.c:1519 [inline]\n__run_timers+0x54c/0x710 kernel/time/timer.c:1790\nrun_timer_softirq+0x28/0x4c kernel/time/timer.c:1803\n_stext+0x380/0xfbc\n____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79\ncall_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:891\ndo_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84\ninvoke_softirq kernel/softirq.c:437 [inline]\n__irq_exit_rcu+0x1c0/0x4cc kernel/softirq.c:683\nirq_exit_rcu+0x14/0x78 kernel/softirq.c:695\nel0_interrupt+0x7c/0x2e0 arch/arm64/kernel/entry-common.c:717\n__el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724\nel0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729\nel0t_64_irq+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584"
}
],
"providerMetadata": {
"dateUpdated": "2025-12-08T01:19:12.407Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/31cf7853a940181593e4472fc56f46574123f9f6"
},
{
"url": "https://git.kernel.org/stable/c/e4ffc47a1c3e5d11a853aa178c9a5136e79412e9"
},
{
"url": "https://git.kernel.org/stable/c/bf7da02d2b8faf324206e1cbe64a4813ff903cc1"
},
{
"url": "https://git.kernel.org/stable/c/915d975b2ffa58a14bfcf16fafe00c41315949ff"
}
],
"title": "net: deal with integer overflows in kmalloc_reserve()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53752",
"datePublished": "2025-12-08T01:19:12.407Z",
"dateReserved": "2025-12-08T01:18:04.279Z",
"dateUpdated": "2025-12-08T01:19:12.407Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-53752\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-08T02:15:50.713\",\"lastModified\":\"2025-12-08T18:26:19.900\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: deal with integer overflows in kmalloc_reserve()\\n\\nBlamed commit changed:\\n ptr = kmalloc(size);\\n if (ptr)\\n size = ksize(ptr);\\n\\n size = kmalloc_size_roundup(size);\\n ptr = kmalloc(size);\\n\\nThis allowed various crash as reported by syzbot [1]\\nand Kyle Zeng.\\n\\nProblem is that if @size is bigger than 0x80000001,\\nkmalloc_size_roundup(size) returns 2^32.\\n\\nkmalloc_reserve() uses a 32bit variable (obj_size),\\nso 2^32 is truncated to 0.\\n\\nkmalloc(0) returns ZERO_SIZE_PTR which is not handled by\\nskb allocations.\\n\\nFollowing trace can be triggered if a netdev-\u003emtu is set\\nclose to 0x7fffffff\\n\\nWe might in the future limit netdev-\u003emtu to more sensible\\nlimit (like KMALLOC_MAX_SIZE).\\n\\nThis patch is based on a syzbot report, and also a report\\nand tentative fix from Kyle Zeng.\\n\\n[1]\\nBUG: KASAN: user-memory-access in __build_skb_around net/core/skbuff.c:294 [inline]\\nBUG: KASAN: user-memory-access in __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527\\nWrite of size 32 at addr 00000000fffffd10 by task syz-executor.4/22554\\n\\nCPU: 1 PID: 22554 Comm: syz-executor.4 Not tainted 6.1.39-syzkaller #0\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023\\nCall trace:\\ndump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:279\\nshow_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:286\\n__dump_stack lib/dump_stack.c:88 [inline]\\ndump_stack_lvl+0x120/0x1a0 lib/dump_stack.c:106\\nprint_report+0xe4/0x4b4 mm/kasan/report.c:398\\nkasan_report+0x150/0x1ac mm/kasan/report.c:495\\nkasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189\\nmemset+0x40/0x70 mm/kasan/shadow.c:44\\n__build_skb_around net/core/skbuff.c:294 [inline]\\n__alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527\\nalloc_skb include/linux/skbuff.h:1316 [inline]\\nigmpv3_newpack+0x104/0x1088 net/ipv4/igmp.c:359\\nadd_grec+0x81c/0x1124 net/ipv4/igmp.c:534\\nigmpv3_send_cr net/ipv4/igmp.c:667 [inline]\\nigmp_ifc_timer_expire+0x1b0/0x1008 net/ipv4/igmp.c:810\\ncall_timer_fn+0x1c0/0x9f0 kernel/time/timer.c:1474\\nexpire_timers kernel/time/timer.c:1519 [inline]\\n__run_timers+0x54c/0x710 kernel/time/timer.c:1790\\nrun_timer_softirq+0x28/0x4c kernel/time/timer.c:1803\\n_stext+0x380/0xfbc\\n____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79\\ncall_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:891\\ndo_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84\\ninvoke_softirq kernel/softirq.c:437 [inline]\\n__irq_exit_rcu+0x1c0/0x4cc kernel/softirq.c:683\\nirq_exit_rcu+0x14/0x78 kernel/softirq.c:695\\nel0_interrupt+0x7c/0x2e0 arch/arm64/kernel/entry-common.c:717\\n__el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724\\nel0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729\\nel0t_64_irq+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/31cf7853a940181593e4472fc56f46574123f9f6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/915d975b2ffa58a14bfcf16fafe00c41315949ff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bf7da02d2b8faf324206e1cbe64a4813ff903cc1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e4ffc47a1c3e5d11a853aa178c9a5136e79412e9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…