CVE-2023-53517— Linux kernel 安全漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2023-53517の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
tipc: do not update mtu if msg_max is too small in mtu negotiation
ソース: NVD (National Vulnerability Database)
脆弱性説明
In the Linux kernel, the following vulnerability has been resolved: tipc: do not update mtu if msg_max is too small in mtu negotiation When doing link mtu negotiation, a malicious peer may send Activate msg with a very small mtu, e.g. 4 in Shuang's testing, without checking for the minimum mtu, l->mtu will be set to 4 in tipc_link_proto_rcv(), then n->links[bearer_id].mtu is set to 4294967228, which is a overflow of '4 - INT_H_SIZE - EMSG_OVERHEAD' in tipc_link_mss(). With tipc_link.mtu = 4, tipc_link_xmit() kept printing the warning: tipc: Too large msg, purging xmit list 1 5 0 40 4! tipc: Too large msg, purging xmit list 1 15 0 60 4! And with tipc_link_entry.mtu 4294967228, a huge skb was allocated in named_distribute(), and when purging it in tipc_link_xmit(), a crash was even caused: general protection fault, probably for non-canonical address 0x2100001011000dd: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 6.3.0.neta #19 RIP: 0010:kfree_skb_list_reason+0x7e/0x1f0 Call Trace: <IRQ> skb_release_data+0xf9/0x1d0 kfree_skb_reason+0x40/0x100 tipc_link_xmit+0x57a/0x740 [tipc] tipc_node_xmit+0x16c/0x5c0 [tipc] tipc_named_node_up+0x27f/0x2c0 [tipc] tipc_node_write_unlock+0x149/0x170 [tipc] tipc_rcv+0x608/0x740 [tipc] tipc_udp_recv+0xdc/0x1f0 [tipc] udp_queue_rcv_one_skb+0x33e/0x620 udp_unicast_rcv_skb.isra.72+0x75/0x90 __udp4_lib_rcv+0x56d/0xc20 ip_protocol_deliver_rcu+0x100/0x2d0 This patch fixes it by checking the new mtu against tipc_bearer_min_mtu(), and not updating mtu if it is too small.
ソース: NVD (National Vulnerability Database)
CVSS情報
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
N/A
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Linux kernel 安全漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未检查最小mtu值，可能导致整数溢出和内存损坏。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
II. CVE-2023-53517の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2023-53517のインテリジェンス情報
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-10-01 · 169 CVEs total
| CVE-2022-50461 | net: ethernet: ti: am65-cpsw: Fix PM runtime leakage in am65_cpsw_nuss_ndo_slave_open() | |
| CVE-2022-50448 | mm/uffd: fix warning without PTE_MARKER_UFFD_WP compiled in | |
| CVE-2022-50452 | net: sched: cake: fix null pointer access issue when cake_init() fails | |
| CVE-2022-50451 | fs/ntfs3: Fix memory leak on ntfs_fill_super() error path | |
| CVE-2022-50453 | gpiolib: cdev: fix NULL-pointer dereferences | |
| CVE-2022-50454 | drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table() | |
| CVE-2022-50457 | mtd: core: Fix refcount error in del_mtd_device() | |
| CVE-2022-50456 | btrfs: fix resolving backrefs for inline extent followed by prealloc | |
| CVE-2022-50458 | clk: tegra: Fix refcount leak in tegra210_clock_init | |
| CVE-2022-50460 | cifs: Fix xid leak in cifs_flock() | |
| CVE-2022-50459 | scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() | |
| CVE-2022-50466 | fs/binfmt_elf: Fix memory leak in load_elf_binary() | |
| CVE-2023-53489 | tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. | |
| CVE-2022-50469 | staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw() | |
| CVE-2022-50468 | platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() | |
| CVE-2022-50467 | scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID | |
| CVE-2022-50464 | mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2() | |
| CVE-2022-50462 | MIPS: vpe-mt: fix possible memory leak while module exiting | |
| CVE-2022-50463 | powerpc/52xx: Fix a resource leak in an error handling path | |
| CVE-2022-50449 | clk: samsung: Fix memory leak in _samsung_clk_register_pll() |
Showing 20 of 169 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
同じベンダー: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. CVE-2023-53517へのコメント
まだコメントはありません