linux: In the Linux kernel, the following vulnerability has been resolved: net: Fix load-tearing on sk->sk_stamp in sock_re...
CVE-2023-54218 is fixed in 20 products on 1 platform, first by ALAS2023-2023-228, released June 21, 2023. It is not reported as exploited. Patch Radar priority: High.
In the Linux kernel, the following vulnerability has been resolved: net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs(). KCSAN found a data race in sock_recv_cmsgs() where the read access to sk->sk_stamp needs READ_ONCE(). BUG: KCSAN: data-race in packet_recvmsg / packet_recvmsg write (marked) to 0xffff88803c81f258 of 8 bytes by task 19171 on cpu 0: sock_write_timestamp include/net/sock.h:2670 [inline] sock_recv_cmsgs include/net/sock.h:2722 [inline] packet_recvmsg+0xb97/0xd00 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:1019 [inline] sock_recvmsg+0x11a/0x130 net/socket.c:1040 sock_read_iter+0x176/0x220 net/socket.c:1118 call_read_iter include/linux/fs.h:1845 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x5e0/0x630 fs/read_write.c:470 ksys_read+0x163/0x1a0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x41/0x50 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc read to 0xffff88803c81f258 of 8 bytes by task 19183 on cpu 1: sock_recv_cmsgs include/net/sock.h:2721 [inline] packet_recvmsg+0xb64/0xd00 net/packet/af_packet.c:3489 sock_recvmsg_nosec net/socket.c:1019 [inline] sock_recvmsg+0x11a/0x130 net/socket.c:1040 sock_read_iter+0x176/0x220 net/socket.c:1118 call_read_iter include/linux/fs.h:1845 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x5e0/0x630 fs/read_write.c:470 ksys_read+0x163/0x1a0 fs/read_write.c:613 __do_sys_read fs/read_write.c:623 [inline] __se_sys_read fs/read_write.c:621 [inline] __x64_sys_read+0x41/0x50 fs/read_write.c:621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc value changed: 0xffffffffc4653600 -> 0x0000000000000000 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 19183 Comm: syz-executor.5 Not tainted 6.3.0-rc7-02330-gca6270c12e20 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| bpftool · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| bpftool-debuginfo · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| kernel · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| kernel-debuginfo · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| kernel-debuginfo-common-aarch64 · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| kernel-debuginfo-common-x86_64 · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| kernel-devel · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| kernel-headers · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| kernel-libbpf · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| kernel-libbpf-devel · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| kernel-libbpf-static · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| kernel-livepatch-6.1.34-56.100 · amzn 2023 | 1.0-0.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| kernel-tools · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| kernel-tools-debuginfo · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| kernel-tools-devel · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| linux · Debian 12.15 (bookworm) | 6.1.37-1 | DEBIAN-CVE-2023-54218 | Dec 30, 2025 |
| linux · Debian 13.5 (trixie) | 6.3.7-1 | DEBIAN-CVE-2023-54218 | Dec 30, 2025 |
| linux · Debian 14 | 6.3.7-1 | DEBIAN-CVE-2023-54218 | Dec 30, 2025 |
| perf · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| perf-debuginfo · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| python3-perf · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
| python3-perf-debuginfo · amzn 2023 | 6.1.34-56.100.amzn2023 | ALAS2023-2023-228 | Jun 21, 2023 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.