logo_clicknbuy.png

CVE-2023-53020 – Linux Kernel L2TP UDP Tunnel Sock Racy Registration

The following table lists the changes that have been made to the
CVE-2023-53020 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution
of a vulnerability, and for identifying the most recent changes that may
impact the vulnerability’s severity, exploitability, or other characteristics.

  • New CVE Received
    by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Mar. 27, 2025

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved:

    l2tp: close all race conditions in l2tp_tunnel_register()

    The code in l2tp_tunnel_register() is racy in several ways:

    1. It modifies the tunnel socket _after_ publishing it.

    2. It calls setup_udp_tunnel_sock() on an existing socket without
    locking.

    3. It changes sock lock class on fly, which triggers many syzbot
    reports.

    This patch amends all of them by moving socket initialization code
    before publishing and under sock lock. As suggested by Jakub, the
    l2tp lockdep class is not necessary as we can just switch to
    bh_lock_sock_nested().
    Added Reference https://git.kernel.org/stable/c/0b2c59720e65885a394a017d0cf9cab118914682
    Added Reference https://git.kernel.org/stable/c/2d77e5c0ad79004b5ef901895437e9cce6dfcc7e
    Added Reference https://git.kernel.org/stable/c/77e8ed776cdb1a24b2aab8fe7c6f1f154235e1ce
    Added Reference https://git.kernel.org/stable/c/cef0845b6dcfa2f6c2c832e7f9622551456c741d
Share the Post:

Related Posts