{
  "cveId": "CVE-2023-52523",
  "url": "https://patchblox.com/security/cve/CVE-2023-52523",
  "summary": "CVE-2023-52523 is fixed in 21 products on 1 platform, first by ALAS2023-2023-422, released October 30, 2023. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  bpf, sockmap: Reject sk_msg egress redirects to...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets  With a SOCKMAP/SOCKHASH map and an sk_msg program user can steer messages sent from one TCP socket (s1) to actually egress from another TCP socket (s2):  tcp_bpf_sendmsg(s1)\t\t// = sk_prot-\u003Esendmsg   tcp_bpf_send_verdict(s1)\t// __SK_REDIRECT case     tcp_bpf_sendmsg_redir(s2)       tcp_bpf_push_locked(s2) \ttcp_bpf_push(s2) \t  tcp_rate_check_app_limited(s2) // expects tcp_sock \t  tcp_sendmsg_locked(s2)\t // ditto  There is a hard-coded assumption in the call-chain, that the egress socket (s2) is a TCP socket.  However in commit 122e6c79efe1 (\u0022sock_map: Update sock type checks for UDP\u0022) we have enabled redirects to non-TCP sockets. This was done for the sake of BPF sk_skb programs. There was no indention to support sk_msg send-to-egress use case.  As a result, attempts to send-to-egress through a non-TCP socket lead to a crash due to invalid downcast from sock to tcp_sock:   BUG: kernel NULL pointer dereference, address: 000000000000002f  ...  Call Trace:   \u003CTASK\u003E   ? show_regs\u002B0x60/0x70   ? __die\u002B0x1f/0x70   ? page_fault_oops\u002B0x80/0x160   ? do_user_addr_fault\u002B0x2d7/0x800   ? rcu_is_watching\u002B0x11/0x50   ? exc_page_fault\u002B0x70/0x1c0   ? asm_exc_page_fault\u002B0x27/0x30   ? tcp_tso_segs\u002B0x14/0xa0   tcp_write_xmit\u002B0x67/0xce0   __tcp_push_pending_frames\u002B0x32/0xf0   tcp_push\u002B0x107/0x140   tcp_sendmsg_locked\u002B0x99f/0xbb0   tcp_bpf_push\u002B0x19d/0x3a0   tcp_bpf_sendmsg_redir\u002B0x55/0xd0   tcp_bpf_send_verdict\u002B0x407/0x550   tcp_bpf_sendmsg\u002B0x1a1/0x390   inet_sendmsg\u002B0x6a/0x70   sock_sendmsg\u002B0x9d/0xc0   ? sockfd_lookup_light\u002B0x12/0x80   __sys_sendto\u002B0x10e/0x160   ? syscall_enter_from_user_mode\u002B0x20/0x60   ? __this_cpu_preempt_check\u002B0x13/0x20   ? lockdep_hardirqs_on\u002B0x82/0x110   __x64_sys_sendto\u002B0x1f/0x30   do_syscall_64\u002B0x38/0x90   entry_SYSCALL_64_after_hwframe\u002B0x63/0xcd  Reject selecting a non-TCP sockets as redirect target from a BPF sk_msg program to prevent the crash. When attempted, user will receive an EACCES error from send/sendto/sendmsg() syscall.",
  "published": "2023-10-30T23:44:00Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00236,
  "epssPercentile": 0.14665,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "bpftool",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "bpftool-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debuginfo-common-aarch64",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-debuginfo-common-x86_64",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-devel",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-headers",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-libbpf",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-libbpf-devel",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-libbpf-static",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-livepatch-6.1.59-84.139",
      "release": "amzn 2023",
      "fixedVersion": "1.0-0.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-modules-extra",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-tools",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-tools-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "kernel-tools-devel",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.64-1",
      "fix": "DEBIAN-CVE-2023-52523",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52523",
      "released": "2024-03-02T22:15:48Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.5.8-1",
      "fix": "DEBIAN-CVE-2023-52523",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52523",
      "released": "2024-03-02T22:15:48Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.5.8-1",
      "fix": "DEBIAN-CVE-2023-52523",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-52523",
      "released": "2024-03-02T22:15:48Z"
    },
    {
      "platform": "linux",
      "product": "perf",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "perf-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    },
    {
      "platform": "linux",
      "product": "python3-perf-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "6.1.59-84.139.amzn2023",
      "fix": "ALAS2023-2023-422",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2023-422",
      "released": "2023-10-30T23:44:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}