BPF Socket Handling Vulnerability in Linux Kernel

CVE-2023-53585

What is CVE-2023-53585?

A vulnerability exists in the Linux Kernel related to BPF socket handling, which could lead to refcount leaks. Specifically, the bpf_sk_assign function fails to properly manage socket references when dealing with unhashed UDP sockets. These sockets are created without the SOCK_RCU_FREE flag set, allowing for incorrect reference counting. This vulnerability arises during the use of socket-based operations, where a sequence of actions can lead to an improper handling of socket lifecycle events, ultimately violating expected refcounting mechanisms. The issue has been rectified by updating bpf_sk_assign to reject unhashed sockets, aligning its behavior with that of the __inet_lookup_skb function.

References