CVE-2023-53020
Severity CVSS v4.0:
Pending analysis
Type:
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Publication date:
27/03/2025
Last modified:
15/04/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
l2tp: close all race conditions in l2tp_tunnel_register()<br />
<br />
The code in l2tp_tunnel_register() is racy in several ways:<br />
<br />
1. It modifies the tunnel socket _after_ publishing it.<br />
<br />
2. It calls setup_udp_tunnel_sock() on an existing socket without<br />
locking.<br />
<br />
3. It changes sock lock class on fly, which triggers many syzbot<br />
reports.<br />
<br />
This patch amends all of them by moving socket initialization code<br />
before publishing and under sock lock. As suggested by Jakub, the<br />
l2tp lockdep class is not necessary as we can just switch to<br />
bh_lock_sock_nested().
Impact
Base Score 3.x
4.70
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 3.6 (including) | 5.10.166 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.11 (including) | 5.15.91 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 6.1.9 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page