Slab-Use-After-Free Vulnerability in Linux Kernel's xfrm Device

CVE-2023-53500

What is CVE-2023-53500?

A vulnerability exists in the Linux kernel's xfrm device where a slab-use-after-free condition can occur when processing IPv6 packets. When the xfrm device is set to the queueing discipline of type 'sfb', an alteration in the 'cb' field of the transmitted socket buffer (skb) may happen during enqueuing. This vulnerability arises from improper handling of address offsets which can lead to potential memory corruption. It is important for users to update their kernel versions to mitigate this risk.

References