CVE-2023-53698

Vulnerability

Overview

CVE-2023-53698 is a refcount underflow vulnerability in the Linux kernel's AF_XDP (XSK) subsystem. The bug occurs in the error path of xsk_build_skb() when xp_alloc_tx_descs() fails, which can only happen due to insufficient memory [1]. In this path, the reference count of the buffer pool (pool) is decremented after having been incremented earlier, but the pointer to the pool stored in the socket (xs->pool) is not cleared [2].

Attack

Vector and Prerequisites

Exploitation requires a system to be under memory pressure, causing memory allocation failures during AF_XDP socket transmit operations. The attack is local and can be initiated by any user with the ability to create AF_XDP sockets (requiring CAP_NET_ADMIN or root privileges). No remote authentication is needed; the attacker triggers the bug by exhausting memory while using XSK sockets.

Impact

When the socket is closed later, the socket teardown logic sees the stale reference to the pool and decrements the refcount again, resulting in a refcount underflow. This can lead to use-after-free conditions, corruption of kernel memory, system crash (denial of service), or potentially privilege escalation if exploited carefully [1]. The vulnerability was reported by syzbot, a kernel fuzzer, indicating it is reliably triggerable.

Mitigation

The fix was applied in a single-line patch that clears xs->pool in the error path to prevent the double decrement [1]. The stable kernel branch has also incorporated the fix [2]. Users should update their Linux kernel to a version containing the commit 15b453cf7348973217558235b9ece2ee5fea6777 or later. No workaround is available other than applying the patch.