214 lines
12 KiB
JSON
214 lines
12 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-54237",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-12-30T12:06:44.508Z",
|
|
"datePublished": "2025-12-30T12:11:27.028Z",
|
|
"dateUpdated": "2026-10-15T21:41:42.738Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-09-14T11:57:41.872Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()\n\nThere is a certain chance to trigger the following panic:\n\nPID: 5900 TASK: ffff88c1c8af4100 CPU: 1 COMMAND: \"kworker/1:48\"\n #0 [ffff9456c1cc79a0] machine_kexec at ffffffff870665b7\n #1 [ffff9456c1cc79f0] __crash_kexec at ffffffff871b4c7a\n #2 [ffff9456c1cc7ab0] crash_kexec at ffffffff871b5b60\n #3 [ffff9456c1cc7ac0] oops_end at ffffffff87026ce7\n #4 [ffff9456c1cc7ae0] page_fault_oops at ffffffff87075715\n #5 [ffff9456c1cc7b58] exc_page_fault at ffffffff87ad0654\n #6 [ffff9456c1cc7b80] asm_exc_page_fault at ffffffff87c00b62\n [exception RIP: ib_alloc_mr+19]\n RIP: ffffffffc0c9cce3 RSP: ffff9456c1cc7c38 RFLAGS: 00010202\n RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000004\n RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000\n RBP: ffff88c1ea281d00 R8: 000000020a34ffff R9: ffff88c1350bbb20\n R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000\n R13: 0000000000000010 R14: ffff88c1ab040a50 R15: ffff88c1ea281d00\n ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018\n #7 [ffff9456c1cc7c60] smc_ib_get_memory_region at ffffffffc0aff6df [smc]\n #8 [ffff9456c1cc7c88] smcr_buf_map_link at ffffffffc0b0278c [smc]\n #9 [ffff9456c1cc7ce0] __smc_buf_create at ffffffffc0b03586 [smc]\n\nThe reason here is that when the server tries to create a second link,\nsmc_llc_srv_add_link() has no protection and may add a new link to\nlink group. This breaks the security environment protected by\nllc_conf_mutex."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 9.8,
|
|
"baseSeverity": "CRITICAL"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - The vulnerable window is entered only from the SMC-R server listen worker (`smc_listen_work` → `smc_listen_rdma_finish` → `smcr_serv_conf_first_link`) in response to an inbound remote connection, and the racing LLC messages (ADD_LINK/DELETE_LINK) arrive from the remote peer over the RoCE fabric. SMC-Rv2/RoCEv2 traffic is IP-routable and the CLC handshake is plain TCP, so a remote peer reaches this code.\nAC:L - The attacker controls both sides of the race — it initiates the first-contact connection that enters the unprotected `smc_llc_srv_add_link()` window, and independently drives the concurrent `llc_conf_mutex` holders (parallel connections into the same link group doing `smcr_buf_map_usable_links()`, peer-sent DELETE_LINK, or induced link-down), with unlimited retries.\nPR:N - SMC has no authentication at any point in the CLC or LLC handshake; any peer able to complete an SMC-negotiated TCP connection to the listening socket reaches this code path pre-authentication.\nUI:N - The listen worker processes inbound SMC connections automatically with no action from any local user; the whole flow runs in kernel workqueue context.\nS:U - The corruption is confined to kernel link-group and RDMA resource state within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Unsynchronized `smcr_link_init()`/`smcr_link_clear()` against `smcr_buf_map_usable_links()` yields use of freed/zeroed `ib_pd`, `ib_qp` and WR buffers and MRs registered against torn-down protection domains, memory corruption that can be leveraged to disclose kernel and RDMA buffer contents.\nI:H - Concurrent `smcr_link_clear()` on the same link is unguarded (`lnk->clearing` is a non-atomic bitfield), producing double `smc_ib_dealloc_protection_domain()`/`smc_ib_destroy_queue_pair()`/` smc_wr_free_link()` and a `memset()` of a live `struct smc_link` — double-free/use-after-free primitives usable for arbitrary write and control-flow hijack.\nA:H - The commit documents a reproducible kernel panic — page fault in `ib_alloc_mr()` with a NULL protection domain from `__smc_buf_create` → `smcr_buf_map_link` → `smc_ib_get_memory_region` — and the double-free paths crash the kernel as well."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/smc/af_smc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "2d2209f2018943d4152a21eff5b76f1952e0b435",
|
|
"lessThan": "fe35c24b730d38b421da93ac5d493cb4495e8e54",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "2d2209f2018943d4152a21eff5b76f1952e0b435",
|
|
"lessThan": "f2f46de98c11d41ac8d22765f47ba54ce5480a5b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "2d2209f2018943d4152a21eff5b76f1952e0b435",
|
|
"lessThan": "0c764cc271d3aa6528ae1b3394babf34ac01f775",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "2d2209f2018943d4152a21eff5b76f1952e0b435",
|
|
"lessThan": "e40b801b3603a8f90b46acbacdea3505c27f01c0",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/smc/af_smc.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.8",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.8",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.270",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.16",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.2.3",
|
|
"lessThanOrEqual": "6.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "5.10.270"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "6.1.16"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "6.2.3"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "6.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/fe35c24b730d38b421da93ac5d493cb4495e8e54"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/f2f46de98c11d41ac8d22765f47ba54ce5480a5b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0c764cc271d3aa6528ae1b3394babf34ac01f775"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e40b801b3603a8f90b46acbacdea3505c27f01c0"
|
|
}
|
|
],
|
|
"title": "net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2023-54237",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "yes"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-15T21:39:39.742228Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-15T21:41:42.738Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |