{ "cveId": "CVE-2023-54193", "url": "https://patchblox.com/security/cve/CVE-2023-54193", "summary": "CVE-2023-54193 is fixed in 20 products on 1 platform, first by ALAS2023-2023-184, released May 25, 2023. It is not reported as exploited. Patch Radar priority: High.", "title": "linux: In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: remove block_cb from driver_...", "description": "In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: remove block_cb from driver_list before freeing Error handler of tcf_block_bind() frees the whole bo-\u003Ecb_list on error. However, by that time the flow_block_cb instances are already in the driver list because driver ndo_setup_tc() callback is called before that up the call chain in tcf_block_offload_cmd(). This leaves dangling pointers to freed objects in the list and causes use-after-free[0]. Fix it by also removing flow_block_cb instances from driver_list before deallocating them. [0]: [ 279.868433] ================================================================== [ 279.869964] BUG: KASAN: slab-use-after-free in flow_block_cb_setup_simple\u002B0x631/0x7c0 [ 279.871527] Read of size 8 at addr ffff888147e2bf20 by task tc/2963 [ 279.873151] CPU: 6 PID: 2963 Comm: tc Not tainted 6.3.0-rc6\u002B #4 [ 279.874273] Hardware name: QEMU Standard PC (Q35 \u002B ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 279.876295] Call Trace: [ 279.876882] \u003CTASK\u003E [ 279.877413] dump_stack_lvl\u002B0x33/0x50 [ 279.878198] print_report\u002B0xc2/0x610 [ 279.878987] ? flow_block_cb_setup_simple\u002B0x631/0x7c0 [ 279.879994] kasan_report\u002B0xae/0xe0 [ 279.880750] ? flow_block_cb_setup_simple\u002B0x631/0x7c0 [ 279.881744] ? mlx5e_tc_reoffload_flows_work\u002B0x240/0x240 [mlx5_core] [ 279.883047] flow_block_cb_setup_simple\u002B0x631/0x7c0 [ 279.884027] tcf_block_offload_cmd.isra.0\u002B0x189/0x2d0 [ 279.885037] ? tcf_block_setup\u002B0x6b0/0x6b0 [ 279.885901] ? mutex_lock\u002B0x7d/0xd0 [ 279.886669] ? __mutex_unlock_slowpath.constprop.0\u002B0x2d0/0x2d0 [ 279.887844] ? ingress_init\u002B0x1c0/0x1c0 [sch_ingress] [ 279.888846] tcf_block_get_ext\u002B0x61c/0x1200 [ 279.889711] ingress_init\u002B0x112/0x1c0 [sch_ingress] [ 279.890682] ? clsact_init\u002B0x2b0/0x2b0 [sch_ingress] [ 279.891701] qdisc_create\u002B0x401/0xea0 [ 279.892485] ? qdisc_tree_reduce_backlog\u002B0x470/0x470 [ 279.893473] tc_modify_qdisc\u002B0x6f7/0x16d0 [ 279.894344] ? tc_get_qdisc\u002B0xac0/0xac0 [ 279.895213] ? mutex_lock\u002B0x7d/0xd0 [ 279.896005] ? __mutex_lock_slowpath\u002B0x10/0x10 [ 279.896910] rtnetlink_rcv_msg\u002B0x5fe/0x9d0 [ 279.897770] ? rtnl_calcit.isra.0\u002B0x2b0/0x2b0 [ 279.898672] ? __sys_sendmsg\u002B0xb5/0x140 [ 279.899494] ? do_syscall_64\u002B0x3d/0x90 [ 279.900302] ? entry_SYSCALL_64_after_hwframe\u002B0x46/0xb0 [ 279.901337] ? kasan_save_stack\u002B0x2e/0x40 [ 279.902177] ? kasan_save_stack\u002B0x1e/0x40 [ 279.903058] ? kasan_set_track\u002B0x21/0x30 [ 279.903913] ? kasan_save_free_info\u002B0x2a/0x40 [ 279.904836] ? ____kasan_slab_free\u002B0x11a/0x1b0 [ 279.905741] ? kmem_cache_free\u002B0x179/0x400 [ 279.906599] netlink_rcv_skb\u002B0x12c/0x360 [ 279.907450] ? rtnl_calcit.isra.0\u002B0x2b0/0x2b0 [ 279.908360] ? netlink_ack\u002B0x1550/0x1550 [ 279.909192] ? rhashtable_walk_peek\u002B0x170/0x170 [ 279.910135] ? kmem_cache_alloc_node\u002B0x1af/0x390 [ 279.911086] ? _copy_from_iter\u002B0x3d6/0xc70 [ 279.912031] netlink_unicast\u002B0x553/0x790 [ 279.912864] ? netlink_attachskb\u002B0x6a0/0x6a0 [ 279.913763] ? netlink_recvmsg\u002B0x416/0xb50 [ 279.914627] netlink_sendmsg\u002B0x7a1/0xcb0 [ 279.915473] ? netlink_unicast\u002B0x790/0x790 [ 279.916334] ? iovec_from_user.part.0\u002B0x4d/0x220 [ 279.917293] ? netlink_unicast\u002B0x790/0x790 [ 279.918159] sock_sendmsg\u002B0xc5/0x190 [ 279.918938] ____sys_sendmsg\u002B0x535/0x6b0 [ 279.919813] ? import_iovec\u002B0x7/0x10 [ 279.920601] ? kernel_sendmsg\u002B0x30/0x30 [ 279.921423] ? __copy_msghdr\u002B0x3c0/0x3c0 [ 279.922254] ? import_iovec\u002B0x7/0x10 [ 279.923041] ___sys_sendmsg\u002B0xeb/0x170 [ 279.923854] ? copy_msghdr_from_user\u002B0x110/0x110 [ 279.924797] ? ___sys_recvmsg\u002B0xd9/0x130 [ 279.925630] ? __perf_event_task_sched_in\u002B0x183/0x470 [ 279.926656] ? ___sys_sendmsg\u002B0x170/0x170 [ 279.927529] ? ctx_sched_in\u002B0x530/0x530 [ 279.928369] ? update_curr\u002B0x283/0x4f0 [ 279.929185] ? perf_event_update_userpage\u002B0x570/0x570 [ 279.930201] ? __fget_light\u002B0x57/0x520 [ 279.931023] ? __switch_to\u002B0x53d/0xe70 [ 27 ---truncated---", "published": "2023-05-25T17:41:00Z", "severity": "high", "cvss": 7.8, "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "epss": 0.00161, "epssPercentile": 0.05346, "priority": "High", "priorityTier": 3, "exploited": false, "vendorExploited": false, "disclosed": false, "fixes": [ { "platform": "linux", "product": "bpftool", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "bpftool-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-debuginfo-common-aarch64", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-debuginfo-common-x86_64", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-devel", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-headers", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-libbpf", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-libbpf-devel", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-libbpf-static", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-livepatch-6.1.29-47.49", "release": "amzn 2023", "fixedVersion": "1.0-0.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-tools", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-tools-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "kernel-tools-devel", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "linux", "release": "Debian 12.15 (bookworm)", "fixedVersion": "6.1.37-1", "fix": "DEBIAN-CVE-2023-54193", "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-54193", "released": "2025-12-30T13:16:07Z" }, { "platform": "linux", "product": "linux", "release": "Debian 13.5 (trixie)", "fixedVersion": "6.3.7-1", "fix": "DEBIAN-CVE-2023-54193", "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-54193", "released": "2025-12-30T13:16:07Z" }, { "platform": "linux", "product": "linux", "release": "Debian 14", "fixedVersion": "6.3.7-1", "fix": "DEBIAN-CVE-2023-54193", "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-54193", "released": "2025-12-30T13:16:07Z" }, { "platform": "linux", "product": "perf", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "perf-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "python3-perf", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" }, { "platform": "linux", "product": "python3-perf-debuginfo", "release": "amzn 2023", "fixedVersion": "6.1.29-47.49.amzn2023", "fix": "ALAS2023-2023-184", "url": "https://patchblox.com/security/fix/linux/alas2023-2023-184", "released": "2023-05-25T17:41:00Z" } ], "noFixYet": [], "dataAsOf": "2026-11-09T01:18:40Z", "attribution": { "text": "Data: Patchblox Patch Radar", "url": "https://patchblox.com/security/patch-radar", "terms": "https://patchblox.com/security/patch-radar/use-the-data" } }