CVE-2023-52523

What it actually does

The flaw allows a BPF sk_msg program attached to a SOCKMAP/SOCKHASH to redirect egress traffic from a TCP socket to a non-TCP socket, triggering an invalid downcast from sock to tcp_sock that results in a NULL pointer dereference and kernel panic during tcp_write_xmit and related send path functions.

Why it matters to the business

Systems running affected Linux kernels that use BPF sockmap for traffic steering can experience unexpected kernel crashes and service outages; the issue has low exploitability but affects any environment relying on sk_msg redirects after the 122e6c79efe1 change that enabled non-TCP targets for sk_skb programs.

How an attack unfolds

An attacker with the ability to load or influence BPF programs creates a SOCKMAP/SOCKHASH, attaches an sk_msg program that selects a non-TCP socket as the redirect target, then triggers sendmsg/sendto on the source TCP socket; the kernel follows tcp_bpf_send_verdict o tcp_bpf_sendmsg_redir o tcp_bpf_push o tcp_sendmsg_locked and crashes on the invalid tcp_sock assumption.

How to fix it

Upgrade the Linux kernel to a version containing commit bc8b89b6963803a123f64aa9494155a037b3d728 or later; rebuild and reboot with the patched kernel; restrict unprivileged BPF program loading until the update is applied.

How to confirm the fix worked

Confirm the running kernel contains commit bc8b89b6963803a123f64aa9494155a037b3d728; attempt to reproduce the original redirect scenario with a non-TCP target and verify the EACCES error is returned instead of a crash; monitor dmesg for absence of the tcp_tso_segs NULL dereference signature.

Typical attack path

1. Load or attach a malicious sk_msg BPF program to a SOCKMAP/SOCKHASH map
2. Insert a non-TCP socket as a possible redirect target
3. Trigger sendmsg/sendto on the source TCP socket that the program redirects
4. Kernel executes tcp_bpf_push which assumes tcp_sock and dereferences invalid memory
5. Resulting page fault causes kernel oops and panic

How to detect it

Search kernel logs and crash dumps for the exact call trace containing tcp_bpf_push, tcp_bpf_sendmsg_redir, tcp_write_xmit and the BUG: kernel NULL pointer dereference at address 000000000000002f; look for processes invoking sendmsg immediately before the oops and any BPF programs using sk_msg verdict actions.

• BUG: kernel NULL pointer dereference, address: 000000000000002f
• tcp_tso_segs+0x14/0xa0
• tcp_write_xmit+0x67/0xce0
• tcp_bpf_push+0x19d/0x3a0
• tcp_bpf_sendmsg_redir+0x55/0xd0
• tcp_bpf_send_verdict+0x407/0x550

What your security team should do

• Prioritize kernel update on any host exposing sockmap/sk_msg functionality to untrusted workloads
• Audit existing BPF programs and maps for sk_msg egress redirects that could target non-TCP sockets
• Temporarily disable unprivileged BPF loading via sysctl kernel.unprivileged_bpf_disabled=1 where feasible
• Add kernel oops monitoring for the specific tcp_bpf_push call trace to detect attempted exploitation