Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且供應商未提供可用的修補程式。

  - 連結若非 eth 裝置從屬失敗則還原連結的 IFF_SLAVE 旗標 syzbot 報告警告 [1]其中連結裝置本身就是從屬而且我們嘗試將非乙太網路裝置控制為第一個失敗的從屬然後在ether_setup() 還原連結裝置時發生錯誤路徑其也會清除所有旗標。在我之前的修正中[2] 我還原了 IFF_MASTER 旗標但我並未考慮連結裝置本身也可能是設定了 IFF_SLAVE 的從屬裝置的情況因此我們也需要還原該旗標。使用 bond_ether_setup 協助程式執行正確的動作並正確還原連結的旗標。使用 nlmon 裝置重現的步驟 $ ip l add nlmon0 type nlmon $ ip l add bond1 type bond $ ip l add bond2 type bond $ ip l set bond1 master bond2 $ ip l set dev nlmon0 master bond1 $ ip -dl sh dev bond1 22bond1
    <BROADCAST,MULTICAST,MASTER> mtu 1500 qdisc noqueue master bond2 state DOWN 模式 DEFAULT 群組預設 qlen 1000 (現在 bond1 的 IFF_SLAVE 旗標已消失若嘗試將其刪除將會出現警告 [3]) [1] https://syzkaller.appspot.com/bug?id=391c7b1f6522182899efba27d891f1743e8eb3ef [2] commit 7d5cd2ce5292 (連結正確處理從屬失敗時的連結類型變更) [3] 範例警告[ 27.008664] bond1 (從屬 nlmon0)指定的從屬裝置不支援設定 MAC 位址 [ 27.008692] bond1(從屬 nlmon0)呼叫 set_mac_address 時發生錯誤 -95 [ 32.464639] bond1 (取消註冊)已釋放所有從屬 [ 32.464685] ------------[cut here ]------------ [ 32.464686] 警告 CPU1 PID2004 at net/core/dev.c:10829 unregister_netdevice_many+0x72a/0x780 [ 32.464694] 連結的模組br_netfilter bridge bonding virtio_net [ 32.464699] CPU1 PID2004 Comm ip Kdump已載入 未受污染的 5.18.0-rc3+ #47 [ 32.464703] 硬體名稱QEMU Standard PC (Q35 + ICH9, 2009)BIOS 1.16.1-2.fc37 04/01/2014 [32.464704] RIP0010:unregister_netdevice_many+0x72a/0x780 [ 32.464707] 代碼99 fd ff ff ba 90 1a 00 00 48 c7 c6 f4 02 66 96 48 c7 c7 20 4d 35 96 c6 05 fa c7 2b 02 01 e8 be 6f 4a 00 0f 0b e9 73 fd ff ff <0f> 0b e9 5f fd ff 80 3d e3 c7 2b 02 00 0f 85 3b fd ff ff ba 59 [ 32.464710] RSP : 0018:ffffa006422d7820 EFLAGS: 00010206 [ 32.464712] RAX: ffff8f6e077140a0 RBX: ffffa006422d7888 RCX: 0000000000000000 [32.464714] RDX: ffff8f6e12edbe58 RSI: 0000000000000296 RDI: ffffffff96d4a520 [ 32.464716] RBP:
    ffff8f6e07714000 R08ffffffff96d63600 R09ffffa006422d7728 [ 32.464717] R100000000000000ec0 R11
    ffffffff9698c988 R12ffff8f6e12edb140 [ 32.464719] R13dead000000000122 R14dead000000000100 R15
    ffff8f6e12edb140 [ 32.464723] FS: 00007f297c2f1740(0000) GS:ffff8f6e5d900000(0000) knlGS:0000000000000000 [ 32.464725] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 32.464726] CR2: 00007f297bf1c800 CR3:
    00000000115e8000 CR40000000000350ee0 [ 32.464730] 呼叫追踪 [ 32.464763] <TASK> [ 32.464767] rtnl_dellink+0x13e/0x380 [ 32.464776] cred_has_capability.isra.0+0x68/0x100 [ 32.464780]
    __rtnl_unlock+0x33/0x60 [ 32.464783] ? bpf_lsm_capset+0x10/0x10 [ 32.464786] ? security_capable+0x36/0x50 [ 32.464790] rtnetlink_rcv_msg+0x14e/0x3b0 [ 32.464792] ? _copy_to_iter+0xb1/0x790 [ 32.464796] ? post_alloc_hook+0xa0/0x160 [ 32.464799] ? rtnl_calcit.isra.0+0x110/0x110 [ 32.464802] netlink_rcv_skb+0x50/0xf0 [ 32.464806] netlink_unicast+0x216/0x340 [ 32.464809] netlink_sendmsg+0x23f/0x480 [ 32.464812] sock_sendmsg+0x5e/0x60 [ 32.464815]____sys_sendmsg +0x22c/0x270 [32.464818] ? import_iovec+0x17/0x20 [ 32.464821] ? sendmsg_copy_msghdr+0x59/0x90 [ 32.464823] ? do_set_pte+0xa0/0xe0 [ 32.464828] ___sys_sendmsg+0x81/0xc0 [ 32.464832] ? mod_objcg_state+0xc6/0x300 [32.464835] ? refill_obj_stock+0xa9/0x160 [ 32.464838] ? memcg_slab_free_hook+0x1a5/0x1f0 [ 32.464842]
    __sys_sendm ---truncated--- (CVE-2023-53103)

請注意，Nessus 依賴供應商報告的套件存在。

偵測

Linux Distros 未修補的弱點：CVE-2023-53103

medium Nessus Plugin ID 247442

找不到變更記錄