{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-54012", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-24T10:53:46.178Z", "datePublished": "2025-12-24T10:55:44.835Z", "dateUpdated": "2026-08-05T09:16:36.275Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:16:36.275Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fix stack overflow when LRO is disabled for virtual interfaces\n\nWhen the virtual interface's feature is updated, it synchronizes the\nupdated feature for its own lower interface.\nThis propagation logic should be worked as the iteration, not recursively.\nBut it works recursively due to the netdev notification unexpectedly.\nThis problem occurs when it disables LRO only for the team and bonding\ninterface type.\n\n team0\n |\n +------+------+-----+-----+\n | | | | |\nteam1 team2 team3 ... team200\n\nIf team0's LRO feature is updated, it generates the NETDEV_FEAT_CHANGE\nevent to its own lower interfaces(team1 ~ team200).\nIt is worked by netdev_sync_lower_features().\nSo, the NETDEV_FEAT_CHANGE notification logic of each lower interface\nwork iteratively.\nBut generated NETDEV_FEAT_CHANGE event is also sent to the upper\ninterface too.\nupper interface(team0) generates the NETDEV_FEAT_CHANGE event for its own\nlower interfaces again.\nlower and upper interfaces receive this event and generate this\nevent again and again.\nSo, the stack overflow occurs.\n\nBut it is not the infinite loop issue.\nBecause the netdev_sync_lower_features() updates features before\ngenerating the NETDEV_FEAT_CHANGE event.\nAlready synchronized lower interfaces skip notification logic.\nSo, it is just the problem that iteration logic is changed to the\nrecursive unexpectedly due to the notification mechanism.\n\nReproducer:\n\nip link add team0 type team\nethtool -K team0 lro on\nfor i in {1..200}\ndo\n ip link add team$i master team0 type team\n ethtool -K team$i lro on\ndone\n\nethtool -K team0 lro off\n\nIn order to fix it, the notifier_ctx member of bonding/team is introduced." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The attack requires local access to issue rtnetlink RTM_NEWLINK calls to build the stacked team/bonding topology and an ethtool ioctl/netlink call to clear LRO on the master; there is no remote or adjacent packet path that reaches `__netdev_update_features()` with attacker-chosen feature bits.\nAC:L - The bug is fully deterministic with no race or memory-layout dependency — the attacker picks the number of enslaved devices and therefore the recursion depth, guaranteeing stack exhaustion, exactly as the commit's reproducer shows.\nPR:L - Both gates are namespace-relative — `netlink_net_capable(skb, CAP_NET_ADMIN)` in `rtnl_newlink()` and `ns_capable(net->user_ns, CAP_NET_ADMIN)` in `dev_ethtool()` — so an unprivileged user obtains the required CAP_NET_ADMIN inside their own `unshare -Urn` namespace and crashes the whole host.\nUI:N - The attacker performs every step (create master, enslave lowers, enable then disable LRO) unaided; no victim action or pre-existing administrator configuration is needed.\nS:U - The stack overflow corrupts kernel memory and panics the kernel within the same security authority; no hypervisor, IOMMU, or other cross-authority boundary is crossed.\nC:H - On the many affected configurations without CONFIG_VMAP_STACK (the affected range begins at v4.4, plus embedded/32-bit builds), the overflow runs off the stack into `thread_info` and adjacent kernel allocations, a memory-corruption primitive that can be leveraged to disclose arbitrary kernel memory.\nI:H - The same out-of-stack writes deposit attacker-influenced return addresses and pointers into neighbouring kernel memory, the classic pre-VMAP_STACK control-flow-hijacking primitive; consistent with prior kernel.org scoring of recursion-driven stack exhaustion (e.g. CVE-2025-40206).\nA:H - Exhausting the kernel stack is an immediate hard crash — a stack guard-page hit / double fault and panic on VMAP_STACK kernels, arbitrary corruption and oops otherwise — taking down the entire system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/bonding/bond_main.c", "drivers/net/team/team.c", "include/linux/if_team.h", "include/net/bonding.h" ], "versions": [ { "version": "fd867d51f889aec11cca235ebb008578780d052d", "lessThan": "9ea0c5f90a27b5b884d880e146e0f65f3052e401", "status": "affected", "versionType": "git" }, { "version": "fd867d51f889aec11cca235ebb008578780d052d", "lessThan": "4bb955c4d2830a58c08e2a48ab75d75368e3ff36", "status": "affected", "versionType": "git" }, { "version": "fd867d51f889aec11cca235ebb008578780d052d", "lessThan": "cf3b5cd7127cc10c5b12400c545f263f0e5e715c", "status": "affected", "versionType": "git" }, { "version": "fd867d51f889aec11cca235ebb008578780d052d", "lessThan": "ed66e6327a69fec95034cda2ac5b6a57b8b3b622", "status": "affected", "versionType": "git" }, { "version": "fd867d51f889aec11cca235ebb008578780d052d", "lessThan": "6bf00bb3dc7e5b9fb05488e11616e65d64e975fa", "status": "affected", "versionType": "git" }, { "version": "fd867d51f889aec11cca235ebb008578780d052d", "lessThan": "ae9b15fbe63447bc1d3bba3769f409d17ca6fdf6", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/bonding/bond_main.c", "drivers/net/team/team.c", "include/linux/if_team.h", "include/net/bonding.h" ], "versions": [ { "version": "4.4", "status": "affected" }, { "version": "0", "lessThan": "4.4", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.244", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.181", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.114", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.31", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3.5", "lessThanOrEqual": "6.3.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.4.244" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.10.181" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "5.15.114" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.1.31" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.3.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4", "versionEndExcluding": "6.4" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/9ea0c5f90a27b5b884d880e146e0f65f3052e401" }, { "url": "https://git.kernel.org/stable/c/4bb955c4d2830a58c08e2a48ab75d75368e3ff36" }, { "url": "https://git.kernel.org/stable/c/cf3b5cd7127cc10c5b12400c545f263f0e5e715c" }, { "url": "https://git.kernel.org/stable/c/ed66e6327a69fec95034cda2ac5b6a57b8b3b622" }, { "url": "https://git.kernel.org/stable/c/6bf00bb3dc7e5b9fb05488e11616e65d64e975fa" }, { "url": "https://git.kernel.org/stable/c/ae9b15fbe63447bc1d3bba3769f409d17ca6fdf6" } ], "title": "net: fix stack overflow when LRO is disabled for virtual interfaces", "x_generator": { "engine": "bippy-1.2.0" } } } }