CVE-2023-54114

What it actually does

Incorrect mac_header restoration in nsh_gso_segment() error unwind path allows skb_push to exceed headroom, triggering skb_panic when inner GSO handlers reset network_header.

Why it matters to the business

Kernel crashes on systems processing NSH-encapsulated traffic with GSO enabled, causing denial of service and potential loss of network connectivity or stability for dependent services.

How an attack unfolds

An attacker sends specially crafted packets that trigger NSH GSO segmentation followed by an inner protocol GSO failure (such as MPLS), causing the unwind logic to compute an invalid mac_header that leads to a kernel panic on skb_push.

How to fix it

Update the Linux kernel to the commit 2f88c8d38ecf5ed0273f99a067246899ba499eb2 or later stable releases that contain the corrected mac_offset handling in nsh_gso_segment().

How to confirm the fix worked

Confirm the presence of the fix commit in the running kernel source or verify that nsh_gso_segment no longer uses the nhoff calculation for mac_header restoration on GSO error paths.

Typical attack path

1. Craft packet with NSH header and inner protocol that exercises GSO
2. Trigger skb_mac_gso_segment which calls inner GSO handler
3. Inner handler resets network_header and returns error
4. nsh_gso_segment error unwind computes mac_header from stale network_header offset
5. skb_push in unwind path exceeds headroom and panics

How to detect it

Search kernel logs and dmesg for skb_panic traces referencing nsh_gso_segment, skb_push, and skb_mac_gso_segment; inspect crash dumps for invalid mac_header values after NSH GSO paths.

• skb_panic+0xda/0xe0
• nsh_gso_segment+0x4f3/0x570
• skb_push+0x91/0xa0
• invalid opcode: 0000 [#1] PREEMPT SMP KASAN

What your security team should do

• Prioritize kernel upgrades on systems exposing NSH or GSO paths to untrusted traffic
• Monitor for skb_panic call traces involving nsh_gso_segment
• Temporarily disable GSO for affected interfaces if immediate patching is not feasible