CVE-2023-53133

Root has patched CVE-2023-53133 in the linux package for Root:Debian:11. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() When the buffer length of the recvmsg system call is 0, we got the flollowing soft lockup problem: watchdog: BUG: soft lockup - CPU#3 stuck for 27s! [a.out:6149] CPU: 3 PID: 6149 Comm: a.out Kdump: loaded Not tainted 6.2.0+ #30 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:remove_wait_queue+0xb/0xc0 Code: 5e 41 5f c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 57 <41> 56 41 55 41 54 55 48 89 fd 53 48 89 f3 4c 8d 6b 18 4c 8d 73 20 RSP: 0018:ffff88811b5978b8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff88811a7d3780 RCX: ffffffffb7a4d768 RDX: dffffc0000000000 RSI: ffff88811b597908 RDI: ffff888115408040 RBP: 1ffff110236b2f1b R08: 0000000000000000 R09: ffff88811a7d37e7 R10: ffffed10234fa6fc R11: 0000000000000001 R12: ffff88811179b800 R13: 0000000000000001 R14: ffff88811a7d38a8 R15: ffff88811a7d37e0 FS: 00007f6fb5398740(0000) GS:ffff888237180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000000 CR3: 000000010b6ba002 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tcp_msg_wait_data+0x279/0x2f0 tcp_bpf_recvmsg_parser+0x3c6/0x490 inet_recvmsg+0x280/0x290 sock_recvmsg+0xfc/0x120 ____sys_recvmsg+0x160/0x3d0 ___sys_recvmsg+0xf0/0x180 __sys_recvmsg+0xea/0x1a0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc The logic in tcp_bpf_recvmsg_parser is as follows: msg_bytes_ready: copied = sk_msg_recvmsg(sk, psock, msg, len, flags); if (!copied) { wait data; goto msg_bytes_ready; } In this case, "copied" always is 0, the infinite loop occurs. According to the Linux system call man page, 0 should be returned in this case. Therefore, in tcp_bpf_recvmsg_parser(), if the length is 0, directly return. Also modify several other functions with the same problem.

• perf/x86/intel/uncore: Fix die ID init and look up bugs {CVE-2026-43344}
• x86/apic: Disable x2apic on resume if the kernel expects so {CVE-2026-43363}
• drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
• dm: remove fake timeout to avoid leak request {CVE-2026-43314}
• md/bitmap: fix GPF in write_page caused by resize race {CVE-2026-43163}
• drm: Account property blob allocations to memcg {CVE-2026-43287}
• drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
• Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
• net/sched: Fix backlog accounting in qdisc_dequeue_internal {CVE-2025-39677}
• l2tp: avoid one data-race in l2tp_tunnel_del_work() {CVE-2026-23120}
• net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() {CVE-2025-39876}
• espintcp: fix skb leaks {CVE-2025-38057}
• cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() {CVE-2025-37829}
• tipc: fix NULL pointer dereference in tipc_mon_reinit_self() {CVE-2025-37824}
• KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses {CVE-2025-23141}
• virtiofs: add filesystem context source name check {CVE-2025-37773}
• netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets {CVE-2025-22063}
• ppp: Fix KMSAN uninit-value warning with bpf {CVE-2025-21922}
• wifi: cfg80211: regulatory: improve invalid hints checking {CVE-2025-21910}
• wifi: ath11k: fix RCU stall while reaping monitor destination ring {CVE-2024-58097}
• net/sctp: Prevent autoclose integer overflow in sctp_association_init() {CVE-2024-57938}
• ubi: fastmap: Fix duplicate slab cache names while attaching {CVE-2024-53172}
• drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() {CVE-2024-56369}
• firmware: arm_scpi: Check the DVFS OPP count returned by the firmware {CVE-2024-53157}
• vsock: Fix sk_error_queue memory leak {CVE-2024-53118}
• mm: fix NULL pointer dereference in alloc_pages_bulk_noprof {CVE-2024-53113}
• exec: don't WARN for racy path_noexec check {CVE-2024-50010}
• drm/amd/display: Initialize get_bytes_per_element's default to 1 {CVE-2024-49892}
• ppp: do not assume bh is held in ppp_channel_bridge_input() {CVE-2024-49946}
• drm/amd/display: Skip Recompute DSC Params if no Stream on Link {CVE-2024-47683}
• x86/sgx: Fix deadlock in SGX NUMA node search {CVE-2024-49856}
• pktgen: use cpus_read_lock() in pg_net_init() {CVE-2024-46681}
• nfsd: call cache_put if xdr_reserve_space returns NULL {CVE-2024-47737}
• uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind {CVE-2024-46739}
• drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
• net/mlx5: Fix bridge mode operations when there are no VFs {CVE-2024-46857}
• Input: MT - limit max slots {CVE-2024-45008}
• net/mlx5e: SHAMPO, Fix incorrect page release {CVE-2024-46717}
• netfilter: ctnetlink: use helper function to calculate expect ID {CVE-2024-44944}
• lib: objagg: Fix general protection fault {CVE-2024-43846}
• drm/qxl: Add check for drm_cvt_mode {CVE-2024-43829}
• mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems {CVE-2024-42073}
• drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes {CVE-2024-42101}
• RDMA/mlx5: Add check for srq max_sge attribute {CVE-2024-40990}
• tracing: Build event generation tests only as modules {CVE-2024-41004}
• KEYS: trusted: Fix memory leak in tpm2_key_encode() {CVE-2024-36967}
• epoll: be better about file lifetimes {CVE-2024-38580}
• drm/radeon: fix UBSAN warning in kv_dpm.c {CVE-2024-40988}
• RDMA/srpt: Add a check for valid 'mad_agent' pointer {CVE-2023-54274}
• x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction {CVE-2023-54172}
• ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() {CVE-2024-26772}
• iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected {CVE-2024-26891}
• dm: don't attempt to queue IO under RCU…

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser()

When the buffer length of the recvmsg system call is 0, we got the flollowing soft lockup problem:

watchdog: BUG: soft lockup - CPU#3 stuck for 27s! [a.out:6149] CPU: 3 PID: 6149 Comm: a.out Kdump: loaded Not tainted 6.2.0+ #30 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 RIP: 0010:remove_wait_queue+0xb/0xc0 Code: 5e 41 5f c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 41 57 <41> 56 41 55 41 54 55 48 89 fd 53 48 89 f3 4c 8d 6b 18 4c 8d 73 20 RSP: 0018:ffff88811b5978b8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff88811a7d3780 RCX: ffffffffb7a4d768 RDX: dffffc0000000000 RSI: ffff88811b597908 RDI: ffff888115408040 RBP: 1ffff110236b2f1b R08: 0000000000000000 R09: ffff88811a7d37e7 R10: ffffed10234fa6fc R11: 0000000000000001 R12: ffff88811179b800 R13: 0000000000000001 R14: ffff88811a7d38a8 R15: ffff88811a7d37e0 FS: 00007f6fb5398740(0000) GS:ffff888237180000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000000 CR3: 000000010b6ba002 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tcp_msg_wait_data+0x279/0x2f0 tcp_bpf_recvmsg_parser+0x3c6/0x490 inet_recvmsg+0x280/0x290 sock_recvmsg+0xfc/0x120 ____sys_recvmsg+0x160/0x3d0 ___sys_recvmsg+0xf0/0x180 __sys_recvmsg+0xea/0x1a0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc

The logic in tcp_bpf_recvmsg_parser is as follows:

msg_bytes_ready: copied = sk_msg_recvmsg(sk, psock, msg, len, flags); if (!copied) { wait data; goto msg_bytes_ready; }

In this case, "copied" always is 0, the infinite loop occurs.

According to the Linux system call man page, 0 should be returned in this case. Therefore, in tcp_bpf_recvmsg_parser(), if the length is 0, directly return. Also modify several other functions with the same problem.

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes.

The following security bugs were fixed:

• CVE-2021-47212: net/mlx5: Update error handler for UCTX and UMEM (bsc#1222709).
• CVE-2021-47455: ptp: Fix possible memory leak in ptp_clock_register() (bsc#1225254).
• CVE-2021-47527: serial: core: fix transmit-buffer reset and memleak (bsc#1227768).
• CVE-2022-21546: scsi: target: Fix WRITE_SAME No Data Buffer crash (bsc#1242243).
• CVE-2022-49154: KVM: SVM: fix panic on out-of-bounds guest IRQ (bsc#1238167).
• CVE-2022-49622: netfilter: nf_tables: fix crash when nf_trace is enabled (bsc#1239042).
• CVE-2022-49731: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() (bsc#1239071).
• CVE-2022-49764: kABI: workaround 'bpf: Prevent bpf program recursion for raw tracepoint probes' changes (bsc#1242301).
• CVE-2022-49780: scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() (bsc#1242262).
• CVE-2022-49814: kcm: close race conditions on sk_receive_queue (bsc#1242498).
• CVE-2022-49879: ext4: fix BUG_ON() when directory entry has invalid rec_len (bsc#1242733).
• CVE-2022-49881: wifi: cfg80211: fix memory leak in query_regdb_file() (bsc#1242481).
• CVE-2022-49917: ipvs: fix WARNING in ip_vs_app_net_cleanup() (bsc#1242406).
• CVE-2022-49921: net: sched: Fix use after free in red_enqueue() (bsc#1242359).
• CVE-2022-50055: iavf: Fix adminq error handling (bsc#1245039).
• CVE-2022-50087: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (bsc#1245119).
• CVE-2022-50134: RDMA/hfi1: fix potential memory leak in setup_base_ctxt() (bsc#1244802).
• CVE-2022-50200: selinux: Add boundary check in put_entry() (bsc#1245149).
• CVE-2023-52500: Fixed information leaking when processing OPC_INB_SET_CONTROLLER_CONFIG command (bsc#1220883).
• CVE-2023-52927: netfilter: allow exp not to be removed in nf_ct_find_expectation (bsc#1239644).
• CVE-2023-53020: l2tp: fix lockdep splat (bsc#1240224).
• CVE-2023-53090: drm/amdkfd: Fix an illegal memory access (bsc#1242753).
• CVE-2023-53091: ext4: update s_journal_inum if it changes after journal replay (bsc#1242767).
• CVE-2023-53133: bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() (bsc#1242423).
• CVE-2024-26586: mlxsw: spectrum_acl_tcam: Fix stack corruption (bsc#1220243).
• CVE-2024-26825: nfc: nci: free rx_data_reassembly skb on NCI device cleanup (bsc#1223065).
• CVE-2024-26872: RDMA/srpt: Do not register event handler until srpt device is fully setup (bsc#1223115).
• CVE-2024-26875: media: pvrusb2: fix uaf in pvr2_context_set_notify (bsc#1223118).
• CVE-2024-35790: usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (bsc#1224712).
• CVE-2024-35839: kABI fix for netfilter: bridge: replace physindev with physinif in nf_bridge_info (bsc#1224726).
• CVE-2024-38588: ftrace: Fix possible use-after-free issue in ftrace_location() (bsc#1226837).
• CVE-2024-57982: xfrm: state: fix out-of-bounds read during lookup (bsc#1237913).
• CVE-2025-21898: ftrace: Avoid potential division by zero in function_stat_show() (bsc#1240610).
• CVE-2025-21920: vlan: enforce underlying device type (bsc#1240686).
• CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1240799).
• CVE-2025-22035: tracing: Fix use-after-free in print_graph_function_flags during tracer switching (bsc#1241544).
• CVE-2025-23149: tpm: do not start chip while suspended (bsc#1242758).
• CVE-2025-37756: net: tls: explicitly disallow disconnect (bsc#1242515).
• CVE-2025-37757: tipc: fix memory leak in tipc_link_xmit (bsc#1242521).
• CVE-2025-37781: i2c: cros-ec-tunnel: defer probe if parent EC is not present (bsc#1242575).
• CVE-2025-37800: driver core: fix potential NULL pointer dereference in dev_uevent() (bsc#1242849).
• CVE-2025-37810: usb: dwc3: gadget: check that event count does not exceed event buffer length (bsc#1242906).
• CVE-2025-37836: PCI: Fix reference…