CVE-2023-53995

Vulnerability

A memory leak vulnerability exists in the Linux kernel's IPv4 address management function __inet_del_ifa(). When a primary IP address is deleted on an interface that has promote_secondaries enabled, the function incorrectly identifies the 'last_prim' entry, causing a secondary address to be skipped during promotion. This leads to the secondary address being orphaned, resulting in a leak of the in_device and net_device reference counts [1][2][3].

Exploitation

An attacker with local network configuration privileges can trigger this vulnerability by executing a specific sequence of ip addr and sysctl commands as shown in the official report. The reproducer requires creating a bond interface, enabling promote_secondaries, adding specific IPv4 addresses with varying scopes, deleting one primary address, and then removing the bond device. The bug is exercised during the deletion of the primary address, causing the secondary address (0.0.0.4/0) to be lost rather than promoted [1][2][3].

Impact

Successful exploitation leads to a memory leak of the secondary address's in_device structure and an unreleased reference to the network device. Over repeated operations, this can exhaust kernel memory and cause the device to become permanently stuck in a busy state, as indicated by the warning "unregister_netdevice: waiting for bond0 to become free. Usage count = 2" [1][2][3].

Mitigation

The vulnerability was fixed in the Linux kernel by adjusting the last_prim search logic to start from the location of the deleted IP address and inserting the promoted IP into that same slot. The fix is included in kernel versions that contain the commits referenced in the advisory [1][2][3]. Users should update to a patched kernel version to prevent exploitation.