{ "cveId": "CVE-2023-53685", "url": "https://patchblox.com/security/cve/CVE-2023-53685", "summary": "CVE-2023-53685 is fixed in 20 products on 1 platform, first by ALAS2023-2023-228, released June 21, 2023. It is not reported as exploited. Patch Radar priority: Routine.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: tun: Fix memory leak for detached NAPI queue", "description": "In the Linux kernel, the following vulnerability has been resolved: tun: Fix memory leak for detached NAPI queue. syzkaller reported [0] memory leaks of sk and skb related to the TUN device with no repro, but we can reproduce it easily with: struct ifreq ifr = {} int fd_tun, fd_tmp; char buf[4] = {}; fd_tun = openat(AT_FDCWD, \u0022/dev/net/tun\u0022, O_WRONLY, 0); ifr.ifr_flags = IFF_TUN | IFF_NAPI | IFF_MULTI_QUEUE; ioctl(fd_tun, TUNSETIFF, \u0026ifr); ifr.ifr_flags = IFF_DETACH_QUEUE; ioctl(fd_tun, TUNSETQUEUE, \u0026ifr); fd_tmp = socket(AF_PACKET, SOCK_PACKET, 0); ifr.ifr_flags = IFF_UP; ioctl(fd_tmp, SIOCSIFFLAGS, \u0026ifr); write(fd_tun, buf, sizeof(buf)); close(fd_tun); If we enable NAPI and multi-queue on a TUN device, we can put skb into tfile-\u003Esk.sk_write_queue after the queue is detached. We should prevent it by checking tfile-\u003Edetached before queuing skb. Note this must be done under tfile-\u003Esk.sk_write_queue.lock because write() and ioctl(IFF_DETACH_QUEUE) can run concurrently. Otherwise, there would be a small race window: write() ioctl(IFF_DETACH_QUEUE) \u0060- tun_get_user \u0060- __tun_detach |- if (tfile-\u003Edetached) |- tun_disable_queue | \u0060-\u003E false | \u0060- tfile-\u003Edetached = tun | \u0060- tun_queue_purge |- spin_lock_bh(\u0026queue-\u003Elock) \u0060- __skb_queue_tail(queue, skb) Another solution is to call tun_queue_purge() when closing and reattaching the detached queue, but it could paper over another problems. Also, we do the same kind of test for IFF_NAPI_FRAGS. [0]: unreferenced object 0xffff88801edbc800 (size 2048): comm \u0022syz-executor.1\u0022, pid 33269, jiffies 4295743834 (age 18.756s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [\u003C000000008c16ea3d\u003E] __do_kmalloc_node mm/slab_common.c:965 [inline] [\u003C000000008c16ea3d\u003E] __kmalloc\u002B0x4a/0x130 mm/slab_common.c:979 [\u003C000000003addde56\u003E] kmalloc include/linux/slab.h:563 [inline] [\u003C000000003addde56\u003E] sk_prot_alloc\u002B0xef/0x1b0 net/core/sock.c:2035 [\u003C000000003e20621f\u003E] sk_alloc\u002B0x36/0x2f0 net/core/sock.c:2088 [\u003C0000000028e43843\u003E] tun_chr_open\u002B0x3d/0x190 drivers/net/tun.c:3438 [\u003C000000001b0f1f28\u003E] misc_open\u002B0x1a6/0x1f0 drivers/char/misc.c:165 [\u003C000000004376f706\u003E] chrdev_open\u002B0x111/0x300 fs/char_dev.c:414 [\u003C00000000614d379f\u003E] do_dentry_open\u002B0x2f9/0x750 fs/open.c:920 [\u003C000000008eb24774\u003E] do_open fs/namei.c:3636 [inline] [\u003C000000008eb24774\u003E] path_openat\u002B0x143f/0x1a30 fs/namei.c:3791 [\u003C00000000955077b5\u003E] do_filp_open\u002B0xce/0x1c0 fs/namei.c:3818 [\u003C00000000b78973b0\u003E] do_sys_openat2\u002B0xf0/0x260 fs/open.c:1356 [\u003C00000000057be699\u003E] do_sys_open fs/open.c:1372 [inline] [\u003C00000000057be699\u003E] __do_sys_openat fs/open.c:1388 [inline] [\u003C00000000057be699\u003E] __se_sys_openat fs/open.c:1383 [inline] [\u003C00000000057be699\u003E] __x64_sys_openat\u002B0x83/0xf0 fs/open.c:1383 [\u003C00000000a7d2182d\u003E] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [\u003C00000000a7d2182d\u003E] do_syscall_64\u002B0x3c/0x90 arch/x86/entry/common.c:80 [\u003C000000004cc4e8c4\u003E] entry_SYSCALL_64_after_hwframe\u002B0x72/0xdc unreferenced object 0xffff88802f671700 (size 240): comm \u0022syz-executor.1\u0022, pid 33269, jiffies 4295743854 (age 18.736s) hex dump (first 32 bytes): 68 c9 db 1e 80 88 ff ff 68 c9 db 1e 80 88 ff ff h.......h....... 00 c0 7b 2f 80 88 ff ff 00 c8 db 1e 80 88 ff ff ..{/............ backtrace: [\u003C00000000e9d9fdb6\u003E] __alloc_skb\u002B0x223/0x250 net/core/skbuff.c:644 [\u003C000000002c3e4e0b\u003E] alloc_skb include/linux/skbuff.h:1288 [inline] [\u003C000000002c3e4e0b\u003E] alloc_skb_with_frags\u002B0x6f/0x350 net/core/skbuff.c:6378 [\u003C00000000825f98d7\u003E] sock_alloc_send_pskb\u002B0x3ac/0x3e0 net/core/sock.c:2729 [\u003C00000000e9eb3df3\u003E] tun_alloc_skb drivers/net/tun.c:1529 [inline] [\u003C ---truncated---", "published": "2023-06-21T19:11:00Z", "severity": "medium", "cvss": 5.5, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "epss": 0.00146, "epssPercentile": 0.03906, "priority": "Routine", "priorityTier": 4, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bpftool", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "bpftool-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "kernel", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "kernel-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "kernel-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "kernel-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "kernel-devel", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "kernel-headers", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "kernel-libbpf", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "kernel-libbpf-devel", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "kernel-libbpf-static", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "kernel-livepatch-6.1.34-56.100", "release": "amzn 2023", "fixedVersion": "1.0-0.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "kernel-tools", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "kernel-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "kernel-tools-devel", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "linux", "release": "Debian 12.15 (bookworm)", "fixedVersion": "6.1.37-1", "fix": "DEBIAN-CVE-2023-53685", "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53685", "released": "2025-10-07T16:15:52Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.3.7-1", "fix": "DEBIAN-CVE-2023-53685", "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53685", "released": "2025-10-07T16:15:52Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "6.3.7-1", "fix": "DEBIAN-CVE-2023-53685", "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-53685", "released": "2025-10-07T16:15:52Z" }, { "platform": "linux", "product": "perf", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "perf-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "python3-perf", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" }, { "platform": "linux", "product": "python3-perf-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.34-56.100.amzn2023", "fix": "ALAS2023-2023-228", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-228", "released": "2023-06-21T19:11:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-08T06:59:42Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }