CVE-2023-53020

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-53020
In the Linux kernel, the following vulnerability has been resolved: l2tp: close all race conditions in l2tp_tunnel_register() The code in l2tp_tunnel_register() is racy in several ways: 1. It modifies the tunnel socket _after_ publishing it. 2. It calls setup_udp_tunnel_sock() on an existing socket without locking. 3. It changes sock lock class on fly, which triggers many syzbot reports. This patch amends all of them by moving socket initialization code before publishing and under sock lock. As suggested by Jakub, the l2tp lockdep class is not necessary as we can just switch to bh_lock_sock_nested().

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0b2c59720e65885a394a017d0cf9cab118914682 Patch
https://git.kernel.org/stable/c/2d77e5c0ad79004b5ef901895437e9cce6dfcc7e Patch
https://git.kernel.org/stable/c/77e8ed776cdb1a24b2aab8fe7c6f1f154235e1ce Patch
https://git.kernel.org/stable/c/cef0845b6dcfa2f6c2c832e7f9622551456c741d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
History

15 Apr 2025, 19:41

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0b2c59720e65885a394a017d0cf9cab118914682 - () https://git.kernel.org/stable/c/0b2c59720e65885a394a017d0cf9cab118914682 - Patch
References () https://git.kernel.org/stable/c/2d77e5c0ad79004b5ef901895437e9cce6dfcc7e - () https://git.kernel.org/stable/c/2d77e5c0ad79004b5ef901895437e9cce6dfcc7e - Patch
References () https://git.kernel.org/stable/c/77e8ed776cdb1a24b2aab8fe7c6f1f154235e1ce - () https://git.kernel.org/stable/c/77e8ed776cdb1a24b2aab8fe7c6f1f154235e1ce - Patch
References () https://git.kernel.org/stable/c/cef0845b6dcfa2f6c2c832e7f9622551456c741d - () https://git.kernel.org/stable/c/cef0845b6dcfa2f6c2c832e7f9622551456c741d - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
First Time Linux linux Kernel
Linux
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: l2tp: cierra todas las condiciones de ejecución en l2tp_tunnel_register() El código en l2tp_tunnel_register() es de alto riesgo de varias maneras: 1. Modifica el socket _after_ publishing it. 2. Llama a setup_udp_tunnel_sock() en un socket existente sin bloquearlo. 3. Cambia la clase de bloqueo de sock sobre la marcha, lo que activa muchos informes de syzbot. Este parche las enmienda todas moviendo el código de inicialización del socket antes de publicarlo y bajo el bloqueo de sock. Como sugirió Jakub, la clase l2tp lockdep no es necesaria ya que podemos simplemente cambiar a bh_lock_sock_nested().
CWE CWE-362

27 Mar 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-27 17:15

Updated : 2025-04-15 19:41

NVD link : CVE-2023-53020

Mitre link : CVE-2023-53020

CVE.ORG link : CVE-2023-53020

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')