Google: sys-kernel/lakitu-kernel-6_1: security update to 17935.0.0

medium Tenable Cloud Security Plugin ID 451568

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- In the Linux kernel, the following vulnerability has been resolved: bpf: reject unhashed sockets in
bpf_sk_assign The semantics for bpf_sk_assign are as follows: sk = some_lookup_func() bpf_sk_assign(skb,
sk) bpf_sk_release(sk) That is, the sk is not consumed by bpf_sk_assign. The function therefore needs to
make sure that sk lives long enough to be consumed from __inet_lookup_skb. The path through the stack for
a TCPv4 packet is roughly: netif_receive_skb_core: takes RCU read lock __netif_receive_skb_core:
sch_handle_ingress: tcf_classify: bpf_sk_assign() deliver_ptype_list_skb: deliver_skb:
ip_packet_type->func == ip_rcv: ip_rcv_core: ip_rcv_finish_core: dst_input: ip_local_deliver:
ip_local_deliver_finish: ip_protocol_deliver_rcu: tcp_v4_rcv: __inet_lookup_skb: skb_steal_sock The
existing helper takes advantage of the fact that everything happens in the same RCU critical section: for
sockets with SOCK_RCU_FREE set bpf_sk_assign never takes a reference. skb_steal_sock then checks
SOCK_RCU_FREE again and does sock_put if necessary. This approach assumes that SOCK_RCU_FREE is never set
on a sk between bpf_sk_assign and skb_steal_sock, but this invariant is violated by unhashed UDP sockets.
A new UDP socket is created in TCP_CLOSE state but without SOCK_RCU_FREE set. That flag is only added in
udp_lib_get_port() which happens when a socket is bound. When bpf_sk_assign was added it wasn't possible
to access unhashed UDP sockets from BPF, so this wasn't a problem. This changed in commit 0c48eefae712
("sock_map: Lift socket state restriction for datagram sockets"), but the helper wasn't adjusted
accordingly. The following sequence of events will therefore lead to a refcount leak: 1. Add
socket(AF_INET, SOCK_DGRAM) to a sockmap. 2. Pull socket out of sockmap and bpf_sk_assign it. Since
SOCK_RCU_FREE is not set we increment the refcount. 3. bind() or connect() the socket, setting
SOCK_RCU_FREE. 4. skb_steal_sock will now set refcounted = false due to SOCK_RCU_FREE. 5. tcp_v4_rcv()
skips sock_put(). Fix the problem by rejecting unhashed sockets in bpf_sk_assign(). This matches the
behaviour of __inet_lookup_skb which is ultimately the goal of bpf_sk_assign(). (CVE-2023-53585)

Solution

Update the sys-kernel/lakitu-kernel-6_1 library and its related packages to version 17935.0.0 or later.

Plugin Details

Severity: Medium

ID: 451568

Version: Revision 1.1

Type: Local

Family: Google COS Security Checks

Published: 10/1/2026

Updated: 10/1/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.42

Vendor

Vendor Severity: LOW

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2023-53585

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 7/21/2021

Reference Information

CVE: CVE-2023-53585

Detections

Analytics