FKIE_CVE-2023-54004

Vulnerability from fkie_nvd - Published: 2025-12-24 11:15 - Updated: 2026-08-04 10:19
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). syzbot reported [0] a null-ptr-deref in sk_get_rmem0() while using IPPROTO_UDPLITE (0x88): 14:25:52 executing program 1: r0 = socket$inet6(0xa, 0x80002, 0x88) We had a similar report [1] for probably sk_memory_allocated_add() in __sk_mem_raise_allocated(), and commit c915fe13cbaa ("udplite: fix NULL pointer dereference") fixed it by setting .memory_allocated for udplite_prot and udplitev6_prot. To fix the variant, we need to set either .sysctl_wmem_offset or .sysctl_rmem. Now UDP and UDPLITE share the same value for .memory_allocated, so we use the same .sysctl_wmem_offset for UDP and UDPLITE. [0]: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 6829 Comm: syz-executor.1 Not tainted 6.4.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 RIP: 0010:sk_get_rmem0 include/net/sock.h:2907 [inline] RIP: 0010:__sk_mem_raise_allocated+0x806/0x17a0 net/core/sock.c:3006 Code: c1 ea 03 80 3c 02 00 0f 85 23 0f 00 00 48 8b 44 24 08 48 8b 98 38 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 <0f> b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 0f 8d 6f 0a 00 00 8b RSP: 0018:ffffc90005d7f450 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90004d92000 RDX: 0000000000000000 RSI: ffffffff88066482 RDI: ffffffff8e2ccbb8 RBP: ffff8880173f7000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000030000 R13: 0000000000000001 R14: 0000000000000340 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880b9800000(0063) knlGS:00000000f7f1cb40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000002e82f000 CR3: 0000000034ff0000 CR4: 00000000003506f0 Call Trace: <TASK> __sk_mem_schedule+0x6c/0xe0 net/core/sock.c:3077 udp_rmem_schedule net/ipv4/udp.c:1539 [inline] __udp_enqueue_schedule_skb+0x776/0xb30 net/ipv4/udp.c:1581 __udpv6_queue_rcv_skb net/ipv6/udp.c:666 [inline] udpv6_queue_rcv_one_skb+0xc39/0x16c0 net/ipv6/udp.c:775 udpv6_queue_rcv_skb+0x194/0xa10 net/ipv6/udp.c:793 __udp6_lib_mcast_deliver net/ipv6/udp.c:906 [inline] __udp6_lib_rcv+0x1bda/0x2bd0 net/ipv6/udp.c:1013 ip6_protocol_deliver_rcu+0x2e7/0x1250 net/ipv6/ip6_input.c:437 ip6_input_finish+0x150/0x2f0 net/ipv6/ip6_input.c:482 NF_HOOK include/linux/netfilter.h:303 [inline] NF_HOOK include/linux/netfilter.h:297 [inline] ip6_input+0xa0/0xd0 net/ipv6/ip6_input.c:491 ip6_mc_input+0x40b/0xf50 net/ipv6/ip6_input.c:585 dst_input include/net/dst.h:468 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] NF_HOOK include/linux/netfilter.h:303 [inline] NF_HOOK include/linux/netfilter.h:297 [inline] ipv6_rcv+0x250/0x380 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5491 __netif_receive_skb+0x1f/0x1c0 net/core/dev.c:5605 netif_receive_skb_internal net/core/dev.c:5691 [inline] netif_receive_skb+0x133/0x7a0 net/core/dev.c:5750 tun_rx_batched+0x4b3/0x7a0 drivers/net/tun.c:1553 tun_get_user+0x2452/0x39c0 drivers/net/tun.c:1989 tun_chr_write_iter+0xdf/0x200 drivers/net/tun.c:2035 call_write_iter include/linux/fs.h:1868 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x945/0xd50 fs/read_write.c:584 ksys_write+0x12b/0x250 fs/read_write.c:637 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 RIP: 0023:0xf7f21579 Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 ---truncated---
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2a112f04629f7839e7cb509b27b8d3b735afe255
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/387bd0a3af3bdd2b16f8dbef0c9fcccac63000a4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5014b64e369bdf997935b132a1ac4d64b6e47ad4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7e3ae83371a4809da6fa3f10ccc430eecef3034a
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ad42a35bdfc6d3c0fc4cb4027d7b2757ce665665
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cc56de054d828935aa37734b479f82fa34b5f9bd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f04c8eaf45e7dcdfccba936506b1ec592a369fb9
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/udplite.c",
            "net/ipv6/udplite.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc56de054d828935aa37734b479f82fa34b5f9bd",
              "status": "affected",
              "version": "850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9",
              "versionType": "git"
            },
            {
              "lessThan": "7e3ae83371a4809da6fa3f10ccc430eecef3034a",
              "status": "affected",
              "version": "850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9",
              "versionType": "git"
            },
            {
              "lessThan": "5014b64e369bdf997935b132a1ac4d64b6e47ad4",
              "status": "affected",
              "version": "850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9",
              "versionType": "git"
            },
            {
              "lessThan": "387bd0a3af3bdd2b16f8dbef0c9fcccac63000a4",
              "status": "affected",
              "version": "850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9",
              "versionType": "git"
            },
            {
              "lessThan": "2a112f04629f7839e7cb509b27b8d3b735afe255",
              "status": "affected",
              "version": "850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9",
              "versionType": "git"
            },
            {
              "lessThan": "f04c8eaf45e7dcdfccba936506b1ec592a369fb9",
              "status": "affected",
              "version": "850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9",
              "versionType": "git"
            },
            {
              "lessThan": "ad42a35bdfc6d3c0fc4cb4027d7b2757ce665665",
              "status": "affected",
              "version": "850cbaddb52dfd4e0c7cabe2c168dd34b44ae0b9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/udplite.c",
            "net/ipv6/udplite.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.284",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.244",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.181",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.31",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nudplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().\n\nsyzbot reported [0] a null-ptr-deref in sk_get_rmem0() while using\nIPPROTO_UDPLITE (0x88):\n\n  14:25:52 executing program 1:\n  r0 = socket$inet6(0xa, 0x80002, 0x88)\n\nWe had a similar report [1] for probably sk_memory_allocated_add()\nin __sk_mem_raise_allocated(), and commit c915fe13cbaa (\"udplite: fix\nNULL pointer dereference\") fixed it by setting .memory_allocated for\nudplite_prot and udplitev6_prot.\n\nTo fix the variant, we need to set either .sysctl_wmem_offset or\n.sysctl_rmem.\n\nNow UDP and UDPLITE share the same value for .memory_allocated, so we\nuse the same .sysctl_wmem_offset for UDP and UDPLITE.\n\n[0]:\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 0 PID: 6829 Comm: syz-executor.1 Not tainted 6.4.0-rc2-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023\nRIP: 0010:sk_get_rmem0 include/net/sock.h:2907 [inline]\nRIP: 0010:__sk_mem_raise_allocated+0x806/0x17a0 net/core/sock.c:3006\nCode: c1 ea 03 80 3c 02 00 0f 85 23 0f 00 00 48 8b 44 24 08 48 8b 98 38 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 \u003c0f\u003e b6 14 02 48 89 d8 83 e0 07 83 c0 03 38 d0 0f 8d 6f 0a 00 00 8b\nRSP: 0018:ffffc90005d7f450 EFLAGS: 00010246\nRAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc90004d92000\nRDX: 0000000000000000 RSI: ffffffff88066482 RDI: ffffffff8e2ccbb8\nRBP: ffff8880173f7000 R08: 0000000000000005 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000000 R12: 0000000000030000\nR13: 0000000000000001 R14: 0000000000000340 R15: 0000000000000001\nFS:  0000000000000000(0000) GS:ffff8880b9800000(0063) knlGS:00000000f7f1cb40\nCS:  0010 DS: 002b ES: 002b CR0: 0000000080050033\nCR2: 000000002e82f000 CR3: 0000000034ff0000 CR4: 00000000003506f0\nCall Trace:\n \u003cTASK\u003e\n __sk_mem_schedule+0x6c/0xe0 net/core/sock.c:3077\n udp_rmem_schedule net/ipv4/udp.c:1539 [inline]\n __udp_enqueue_schedule_skb+0x776/0xb30 net/ipv4/udp.c:1581\n __udpv6_queue_rcv_skb net/ipv6/udp.c:666 [inline]\n udpv6_queue_rcv_one_skb+0xc39/0x16c0 net/ipv6/udp.c:775\n udpv6_queue_rcv_skb+0x194/0xa10 net/ipv6/udp.c:793\n __udp6_lib_mcast_deliver net/ipv6/udp.c:906 [inline]\n __udp6_lib_rcv+0x1bda/0x2bd0 net/ipv6/udp.c:1013\n ip6_protocol_deliver_rcu+0x2e7/0x1250 net/ipv6/ip6_input.c:437\n ip6_input_finish+0x150/0x2f0 net/ipv6/ip6_input.c:482\n NF_HOOK include/linux/netfilter.h:303 [inline]\n NF_HOOK include/linux/netfilter.h:297 [inline]\n ip6_input+0xa0/0xd0 net/ipv6/ip6_input.c:491\n ip6_mc_input+0x40b/0xf50 net/ipv6/ip6_input.c:585\n dst_input include/net/dst.h:468 [inline]\n ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline]\n NF_HOOK include/linux/netfilter.h:303 [inline]\n NF_HOOK include/linux/netfilter.h:297 [inline]\n ipv6_rcv+0x250/0x380 net/ipv6/ip6_input.c:309\n __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5491\n __netif_receive_skb+0x1f/0x1c0 net/core/dev.c:5605\n netif_receive_skb_internal net/core/dev.c:5691 [inline]\n netif_receive_skb+0x133/0x7a0 net/core/dev.c:5750\n tun_rx_batched+0x4b3/0x7a0 drivers/net/tun.c:1553\n tun_get_user+0x2452/0x39c0 drivers/net/tun.c:1989\n tun_chr_write_iter+0xdf/0x200 drivers/net/tun.c:2035\n call_write_iter include/linux/fs.h:1868 [inline]\n new_sync_write fs/read_write.c:491 [inline]\n vfs_write+0x945/0xd50 fs/read_write.c:584\n ksys_write+0x12b/0x250 fs/read_write.c:637\n do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]\n __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178\n do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203\n entry_SYSENTER_compat_after_hwframe+0x70/0x82\nRIP: 0023:0xf7f21579\nCode: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 \u003c5d\u003e 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00\n---truncated---"
    }
  ],
  "id": "CVE-2023-54004",
  "lastModified": "2026-08-04T10:19:25.330",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-12-24T11:15:53.320",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2a112f04629f7839e7cb509b27b8d3b735afe255"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/387bd0a3af3bdd2b16f8dbef0c9fcccac63000a4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5014b64e369bdf997935b132a1ac4d64b6e47ad4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7e3ae83371a4809da6fa3f10ccc430eecef3034a"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ad42a35bdfc6d3c0fc4cb4027d7b2757ce665665"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cc56de054d828935aa37734b479f82fa34b5f9bd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f04c8eaf45e7dcdfccba936506b1ec592a369fb9"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.