CVE-2023-53685: In the Linux kernel, the following vulnerability has been resolved: tun: Fix memory leak for detached NAPI queue. syzkaller reported [0] memory leaks of sk and…

PriorityP420medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.13%

3.3th percentile

In the Linux kernel, the following vulnerability has been resolved: tun: Fix memory leak for detached NAPI queue. syzkaller reported [0] memory leaks of sk and skb related to the TUN device with no repro, but we can reproduce it easily with: struct ifreq ifr = {} int fd_tun, fd_tmp; char buf[4] = {}; fd_tun = openat(AT_FDCWD, "/dev/net/tun", O_WRONLY, 0); ifr.ifr_flags = IFF_TUN | IFF_NAPI | IFF_MULTI_QUEUE; ioctl(fd_tun, TUNSETIFF, &ifr); ifr.ifr_flags = IFF_DETACH_QUEUE; ioctl(fd_tun, TUNSETQUEUE, &ifr); fd_tmp = socket(AF_PACKET, SOCK_PACKET, 0); ifr.ifr_flags = IFF_UP; ioctl(fd_tmp, SIOCSIFFLAGS, &ifr); write(fd_tun, buf, sizeof(buf)); close(fd_tun); If we enable NAPI and multi-queue on a TUN device, we can put skb into tfile->sk.sk_write_queue after the queue is detached. We should prevent it by checking tfile->detached before queuing skb. Note this must be done under tfile->sk.sk_write_queue.lock because write() and ioctl(IFF_DETACH_QUEUE) can run concurrently. Otherwise, there would be a small race window: write() ioctl(IFF_DETACH_QUEUE) `- tun_get_user `- __tun_detach |- if (tfile->detached) |- tun_disable_queue | `-> false | `- tfile->detached = tun | `- tun_queue_purge |- spin_lock_bh(&queue->lock) `- __skb_queue_tail(queue, skb) Another solution is to call tun_queue_purge() when closing and reattaching the detached queue, but it could paper over another problems. Also, we do the same kind of test for IFF_NAPI_FRAGS. [0]: unreferenced object 0xffff88801edbc800 (size 2048): comm "syz-executor.1", pid 33269, jiffies 4295743834 (age 18.756s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [] __do_kmalloc_node mm/slab_common.c:965 [inline] [] __kmalloc+0x4a/0x130 mm/slab_common.c:979 [] kmalloc include/linux/slab.h:563 [inline] [] sk_prot_alloc+0xef/0x1b0 net/core/sock.c:2035 [] sk_alloc+0x36/0x2f0 net/core/sock.c:2088 [] tun_chr_

Affected

11 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.37-1 (bookworm)	linux 6.1.37-1 (bookworm)
linux	linux	—	—
linux	linux	>= cde8b15f1aabe327038ee4e0e11dd6b798572f69 < 9cae243b9ae25adfe468cd47ceca591f6725b79c	9cae243b9ae25adfe468cd47ceca591f6725b79c
linux	linux	>= cde8b15f1aabe327038ee4e0e11dd6b798572f69 < 0d20210a190f76db9ec35ee4e0fc77e6c7a148f5	0d20210a190f76db9ec35ee4e0fc77e6c7a148f5
linux	linux	>= cde8b15f1aabe327038ee4e0e11dd6b798572f69 < 82b2bc279467c875ec36f8ef820f00997c2a4e8e	82b2bc279467c875ec36f8ef820f00997c2a4e8e
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 6.1.37-1	6.1.37-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 0 < 6.3.7-1	6.3.7-1
linux	linux_kernel	>= 3.8 < 6.1.30	6.1.30
linux	linux_kernel	>= 6.2 < 6.3.4	6.3.4

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv5.5MEDIUM

vendor_debian5.5MEDIUM

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.