CVE-2023-54094 - Vulnerability Details

Vendors	Products
Linux	Linux Kernel

Link	Providers
https://git.kernel.org/stable/c/1731234e8b60063eae858c77b55c7a88f5084353
https://git.kernel.org/stable/c/7a59f29961cf97b98b02acaadf5a0b1f8dde938c
https://git.kernel.org/stable/c/bc3ab5d2ab69823f5cff89cf74ef78ffa0386c9a
https://git.kernel.org/stable/c/c329b261afe71197d9da83c1f18eb45a7e97e089
https://git.kernel.org/stable/c/ea438eed94ac0fe69b93ac034738823c0e989a12

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: prevent skb corruption on frag list segmentation Ian reported several skb corruptions triggered by rx-gro-list, collecting different oops alike: [ 62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0 [ 62.631083] #PF: supervisor read access in kernel mode [ 62.636312] #PF: error_code(0x0000) - not-present page [ 62.641541] PGD 0 P4D 0 [ 62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364 [ 62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022 [ 62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858 ./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261 net/ipv4/udp_offload.c:277) [ 62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246 [ 62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000 [ 62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4 [ 62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9 [ 62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2 [ 62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9 [ 62.728654] FS: 0000000000000000(0000) GS:ffffa127efa40000(0000) knlGS:0000000000000000 [ 62.736852] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0 [ 62.749948] Call Trace: [ 62.752498] <TASK> [ 62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398) [ 62.787605] skb_mac_gso_segment (net/core/gro.c:141) [ 62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2)) [ 62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862 net/core/dev.c:3659) [ 62.804695] validate_xmit_skb_list (net/core/dev.c:3710) [ 62.809158] sch_direct_xmit (net/sched/sch_generic.c:330) [ 62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210) net/netfilter/core.c:626) [ 62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55) [ 62.825652] maybe_deliver (net/bridge/br_forward.c:193) [ 62.829420] br_flood (net/bridge/br_forward.c:233) [ 62.832758] br_handle_frame_finish (net/bridge/br_input.c:215) [ 62.837403] br_handle_frame (net/bridge/br_input.c:298 net/bridge/br_input.c:416) [ 62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387) [ 62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570) [ 62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638 net/core/dev.c:5727) [ 62.876795] napi_complete_done (./include/linux/list.h:37 ./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067) [ 62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191) [ 62.893534] __napi_poll (net/core/dev.c:6498) [ 62.897133] napi_threaded_poll (./include/linux/netpoll.h:89 net/core/dev.c:6640) [ 62.905276] kthread (kernel/kthread.c:379) [ 62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314) [ 62.917119] </TASK> In the critical scenario, rx-gro-list GRO-ed packets are fed, via a bridge, both to the local input path and to an egress device (tun). The segmentation of such packets unsafely writes to the cloned skbs with shared heads. This change addresses the issue by uncloning as needed the to-be-segmented skbs.
Title		net: prevent skb corruption on frag list segmentation
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1731234e8b60063eae858c77b55c7a88f5084353 https://git.kernel.org/stable/c/7a59f29961cf97b98b02acaadf5a0b1f8dde938c https://git.kernel.org/stable/c/bc3ab5d2ab69823f5cff89cf74ef78ffa0386c9a https://git.kernel.org/stable/c/c329b261afe71197d9da83c1f18eb45a7e97e089 https://git.kernel.org/stable/c/ea438eed94ac0fe69b93ac034738823c0e989a12

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-54094", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T13:02:52.516Z", "datePublished": "2025-12-24T13:06:22.446Z", "dateUpdated": "2025-12-24T13:06:22.446Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-12-24T13:06:22.446Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: prevent skb corruption on frag list segmentation\n\nIan reported several skb corruptions triggered by rx-gro-list,\ncollecting different oops alike:\n\n[ 62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0\n[ 62.631083] #PF: supervisor read access in kernel mode\n[ 62.636312] #PF: error_code(0x0000) - not-present page\n[ 62.641541] PGD 0 P4D 0\n[ 62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ 62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364\n[ 62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022\n[ 62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858\n./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261\nnet/ipv4/udp_offload.c:277)\n[ 62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246\n[ 62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000\n[ 62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4\n[ 62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9\n[ 62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2\n[ 62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9\n[ 62.728654] FS: 0000000000000000(0000) GS:ffffa127efa40000(0000)\nknlGS:0000000000000000\n[ 62.736852] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0\n[ 62.749948] Call Trace:\n[ 62.752498] <TASK>\n[ 62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398)\n[ 62.787605] skb_mac_gso_segment (net/core/gro.c:141)\n[ 62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2))\n[ 62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862\nnet/core/dev.c:3659)\n[ 62.804695] validate_xmit_skb_list (net/core/dev.c:3710)\n[ 62.809158] sch_direct_xmit (net/sched/sch_generic.c:330)\n[ 62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210)\nnet/netfilter/core.c:626)\n[ 62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55)\n[ 62.825652] maybe_deliver (net/bridge/br_forward.c:193)\n[ 62.829420] br_flood (net/bridge/br_forward.c:233)\n[ 62.832758] br_handle_frame_finish (net/bridge/br_input.c:215)\n[ 62.837403] br_handle_frame (net/bridge/br_input.c:298\nnet/bridge/br_input.c:416)\n[ 62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387)\n[ 62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570)\n[ 62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638\nnet/core/dev.c:5727)\n[ 62.876795] napi_complete_done (./include/linux/list.h:37\n./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067)\n[ 62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191)\n[ 62.893534] __napi_poll (net/core/dev.c:6498)\n[ 62.897133] napi_threaded_poll (./include/linux/netpoll.h:89\nnet/core/dev.c:6640)\n[ 62.905276] kthread (kernel/kthread.c:379)\n[ 62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314)\n[ 62.917119] </TASK>\n\nIn the critical scenario, rx-gro-list GRO-ed packets are fed, via a\nbridge, both to the local input path and to an egress device (tun).\n\nThe segmentation of such packets unsafely writes to the cloned skbs\nwith shared heads.\n\nThis change addresses the issue by uncloning as needed the\nto-be-segmented skbs."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/skbuff.c"], "versions": [{"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "bc3ab5d2ab69823f5cff89cf74ef78ffa0386c9a", "status": "affected", "versionType": "git"}, {"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "ea438eed94ac0fe69b93ac034738823c0e989a12", "status": "affected", "versionType": "git"}, {"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "1731234e8b60063eae858c77b55c7a88f5084353", "status": "affected", "versionType": "git"}, {"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "7a59f29961cf97b98b02acaadf5a0b1f8dde938c", "status": "affected", "versionType": "git"}, {"version": "3a1296a38d0cf62bffb9a03c585cbd5dbf15d596", "lessThan": "c329b261afe71197d9da83c1f18eb45a7e97e089", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/skbuff.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.188", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.121", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.40", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.4.5", "lessThanOrEqual": "6.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.5", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.10.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.15.121"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.4.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.5"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bc3ab5d2ab69823f5cff89cf74ef78ffa0386c9a"}, {"url": "https://git.kernel.org/stable/c/ea438eed94ac0fe69b93ac034738823c0e989a12"}, {"url": "https://git.kernel.org/stable/c/1731234e8b60063eae858c77b55c7a88f5084353"}, {"url": "https://git.kernel.org/stable/c/7a59f29961cf97b98b02acaadf5a0b1f8dde938c"}, {"url": "https://git.kernel.org/stable/c/c329b261afe71197d9da83c1f18eb45a7e97e089"}], "title": "net: prevent skb corruption on frag list segmentation", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: prevent skb corruption on frag list segmentation\n\nIan reported several skb corruptions triggered by rx-gro-list,\ncollecting different oops alike:\n\n[ 62.624003] BUG: kernel NULL pointer dereference, address: 00000000000000c0\n[ 62.631083] #PF: supervisor read access in kernel mode\n[ 62.636312] #PF: error_code(0x0000) - not-present page\n[ 62.641541] PGD 0 P4D 0\n[ 62.644174] Oops: 0000 [#1] PREEMPT SMP NOPTI\n[ 62.648629] CPU: 1 PID: 913 Comm: napi/eno2-79 Not tainted 6.4.0 #364\n[ 62.655162] Hardware name: Supermicro Super Server/A2SDi-12C-HLN4F, BIOS 1.7a 10/13/2022\n[ 62.663344] RIP: 0010:__udp_gso_segment (./include/linux/skbuff.h:2858\n./include/linux/udp.h:23 net/ipv4/udp_offload.c:228 net/ipv4/udp_offload.c:261\nnet/ipv4/udp_offload.c:277)\n[ 62.687193] RSP: 0018:ffffbd3a83b4f868 EFLAGS: 00010246\n[ 62.692515] RAX: 00000000000000ce RBX: 0000000000000000 RCX: 0000000000000000\n[ 62.699743] RDX: ffffa124def8a000 RSI: 0000000000000079 RDI: ffffa125952a14d4\n[ 62.706970] RBP: ffffa124def8a000 R08: 0000000000000022 R09: 00002000001558c9\n[ 62.714199] R10: 0000000000000000 R11: 00000000be554639 R12: 00000000000000e2\n[ 62.721426] R13: ffffa125952a1400 R14: ffffa125952a1400 R15: 00002000001558c9\n[ 62.728654] FS: 0000000000000000(0000) GS:ffffa127efa40000(0000)\nknlGS:0000000000000000\n[ 62.736852] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 62.742702] CR2: 00000000000000c0 CR3: 00000001034b0000 CR4: 00000000003526e0\n[ 62.749948] Call Trace:\n[ 62.752498] <TASK>\n[ 62.779267] inet_gso_segment (net/ipv4/af_inet.c:1398)\n[ 62.787605] skb_mac_gso_segment (net/core/gro.c:141)\n[ 62.791906] __skb_gso_segment (net/core/dev.c:3403 (discriminator 2))\n[ 62.800492] validate_xmit_skb (./include/linux/netdevice.h:4862\nnet/core/dev.c:3659)\n[ 62.804695] validate_xmit_skb_list (net/core/dev.c:3710)\n[ 62.809158] sch_direct_xmit (net/sched/sch_generic.c:330)\n[ 62.813198] __dev_queue_xmit (net/core/dev.c:3805 net/core/dev.c:4210)\nnet/netfilter/core.c:626)\n[ 62.821093] br_dev_queue_push_xmit (net/bridge/br_forward.c:55)\n[ 62.825652] maybe_deliver (net/bridge/br_forward.c:193)\n[ 62.829420] br_flood (net/bridge/br_forward.c:233)\n[ 62.832758] br_handle_frame_finish (net/bridge/br_input.c:215)\n[ 62.837403] br_handle_frame (net/bridge/br_input.c:298\nnet/bridge/br_input.c:416)\n[ 62.851417] __netif_receive_skb_core.constprop.0 (net/core/dev.c:5387)\n[ 62.866114] __netif_receive_skb_list_core (net/core/dev.c:5570)\n[ 62.871367] netif_receive_skb_list_internal (net/core/dev.c:5638\nnet/core/dev.c:5727)\n[ 62.876795] napi_complete_done (./include/linux/list.h:37\n./include/net/gro.h:434 ./include/net/gro.h:429 net/core/dev.c:6067)\n[ 62.881004] ixgbe_poll (drivers/net/ethernet/intel/ixgbe/ixgbe_main.c:3191)\n[ 62.893534] __napi_poll (net/core/dev.c:6498)\n[ 62.897133] napi_threaded_poll (./include/linux/netpoll.h:89\nnet/core/dev.c:6640)\n[ 62.905276] kthread (kernel/kthread.c:379)\n[ 62.913435] ret_from_fork (arch/x86/entry/entry_64.S:314)\n[ 62.917119] </TASK>\n\nIn the critical scenario, rx-gro-list GRO-ed packets are fed, via a\nbridge, both to the local input path and to an egress device (tun).\n\nThe segmentation of such packets unsafely writes to the cloned skbs\nwith shared heads.\n\nThis change addresses the issue by uncloning as needed the\nto-be-segmented skbs."}], "id": "CVE-2023-54094", "lastModified": "2025-12-24T13:16:11.280", "metrics": {}, "published": "2025-12-24T13:16:11.280", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1731234e8b60063eae858c77b55c7a88f5084353"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7a59f29961cf97b98b02acaadf5a0b1f8dde938c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bc3ab5d2ab69823f5cff89cf74ef78ffa0386c9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c329b261afe71197d9da83c1f18eb45a7e97e089"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ea438eed94ac0fe69b93ac034738823c0e989a12"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

Metrics

Affected Vendors & Products

Metrics

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object