Data Race Vulnerability in Linux Kernel's DCCP Implementation

CVE-2023-53839

What is CVE-2023-53839?

A vulnerability has been identified in the DCCP (Datagram Congestion Control Protocol) implementation within the Linux kernel, where improper synchronization can lead to data races during socket operations. Specifically, the function dccp_sendmsg() reads the MSS cache before the socket is locked, which may cause inconsistency if simultaneous access occurs. This issue has been addressed by introducing READ_ONCE() and WRITE_ONCE() annotations and ensuring a subsequent check of the MSS cache post-locking. It is crucial for system administrators to apply the latest patches to mitigate potential exploitation.

References