The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
MediumVulnerability
CVE-2023-53585: In the Linux kernel, the following vulnerability has been resolved: bpf: reject unhashed sockets in bpf_sk_assign The…
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2023-53585
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
The Linux kernel's bpf_sk_assign helper accepted unhashed UDP sockets, which do not have SOCK_RCU_FREE set when assigned. If such a socket is later bound or connected, which sets SOCK_RCU_FREE, skb_steal_sock treats the socket as non-refcounted and tcp_v4_rcv skips sock_put, leaking a reference. The flaw was exposed when commit 0c48eefae712 lifted the socket state restriction for datagram sockets in sock_map.
Mitigation
Fixed by rejecting unhashed sockets in bpf_sk_assign(), matching the behaviour of __inet_lookup_skb.