CVE-2023-54161 in Linux
요약
\~에 의해 VulDB • 2026. 07. 01.
Based on the kernel crash dump provided, here is a detailed analysis of the issue.
### **Summary** The system experienced a **Kernel Page Fault (Oops)** while handling a `sendmsg` syscall from user space. The fault occurred inside the memory allocation path for network sockets (`__alloc_skb`). This typically indicates either: 1. A bug in kernel memory management or slab allocator corruption. 2. Severe memory pressure leading to an unexpected failure mode (though usually, this would return `-ENOMEM`, not a page fault). 3. Corrupted pointers passed into the allocation functions.
---
### **Key Evidence from the Dump**
#### **1. The Faulting Instruction & Context** ```text RIP: 0033:0x7f174d639a7d ... ORIG_RAX: 000000000000002e (sys_sendmsg) ``` - The crash happened in user-space code (`RIP` starts with `0x7f...`, which is the typical address range for shared libraries like libc). - The syscall was **`sendmsg`** (`NR 238 on x64, but ORIG_RAX=0x2e = 46 decimal? Wait: On x86_64, `sys_sendmsg` is number 51 (0x33) or similar depending on ABI. Actually, `ORIG_RAX: 0x2e` is **46**, which corresponds to `sendmmsg` in some ABIs, but more likely it's just the raw syscall number for `sendmsg` in this specific kernel version/context). - The user-space program crashed or triggered a signal because of the kernel oops.
#### **2. Call Trace Analysis** The critical part is where the fault occurred: ```text ? kmem_cache_alloc_node+0xa2/0x1e0 ? __alloc_skb+0x16c/0x1e0 __alloc_skb+0x16c/0x1e0 <-- Fault likely here or just before alloc_skb_with_frags+0x48/0x1e0 sock_alloc_send_pskb+0x234/0x270 unix_stream_sendmsg+0x1f5/0x690 <-- Unix Domain Socket send ```
- **`unix_stream_sendmsg`**: The socket type is a **Unix Stream Socket** (AF_UNIX). This is not TCP/IP over Ethernet; it’s local IPC. - **`sock_alloc_send_pskb` → `alloc_skb_with_frags` → `__alloc_skb`**: The kernel was trying to allocate an SKB (Socket Buffer) to hold the data being sent via the Unix socket. - **`kmem_cache_alloc_node`**: This is where memory allocation happens from a slab cache.
#### **3. Why Did It Page Fault?** A page fault in `__alloc_skb` or `kmem_cache_alloc_node` usually means: - The kernel tried to access an invalid virtual address (e.g., NULL pointer dereference, corrupted pointer). - There is memory corruption elsewhere that caused a slab cache structure to be overwritten. - **Note**: Normal OOM conditions return `-ENOMEM`, they do not cause page faults in the allocator itself unless there’s deeper corruption.
---
### **Possible Causes**
#### ✅ 1. Memory Corruption / Slab Poisoning If another part of the kernel wrote out-of-bounds to a nearby object, it could corrupt: - The `kmem_cache` structure. - A pointer inside the allocation path. This leads to an invalid address being dereferenced during allocation.
#### ✅ 2. Bug in Unix Socket Implementation (Rare) If you’re using a custom kernel module or patched network stack, there might be a bug in how `unix_stream_sendmsg` constructs the SKB list before calling `alloc_skb`.
#### ✅ 3. Hardware Issue / ECC Memory Error In rare cases, bit flips in RAM can corrupt kernel data structures mid-execution, leading to invalid pointers and page faults during allocation.
#### ✅ 4. Kernel Bug (Known Issues) Check if your kernel version has known bugs related to: - `unix_stream_sendmsg` - SLUB allocator corruption under high load - Specific network driver interactions (even though this is AF_UNIX, some subsystems share memory pools)
---
### **Recommended Actions**
#### ???? 1. Check Kernel Logs (`dmesg`) Look for messages **before** the oops: ```bash dmesg | tail -n 50 ``` - Look for `slab corruption`, `BUG: unable
If you want to get the best quality for vulnerability data then you always have to consider VulDB.