CVE-2023-52523 is a vulnerability in the Linux kernel related to the Berkeley Packet Filter (BPF) subsystem, specifically involving the sockmap and sk_msg egress redirect functionality. The vulnerability arises from an incorrect assumption in the kernel's TCP socket handling code. The BPF sockmap/sk_msg feature allows user-space programs to redirect messages sent from one TCP socket (s1) to egress through another TCP socket (s2). The kernel code assumes that the egress socket (s2) is always a TCP socket, which is critical because the TCP-specific functions and data structures are accessed during the message send process. However, a recent kernel commit (122e6c79efe1) enabled redirects to non-TCP sockets to support BPF sk_skb programs, but this change did not intend to support sk_msg send-to-egress use cases. Consequently, if a sk_msg program attempts to redirect egress traffic to a non-TCP socket, the kernel performs an invalid downcast from a generic socket to a TCP socket, leading to a NULL pointer dereference and a kernel crash (BUG). This crash occurs due to the kernel trying to access TCP-specific fields on a non-TCP socket, causing a page fault and system instability. The patch for this vulnerability rejects attempts to redirect sk_msg egress traffic to non-TCP sockets, returning an EACCES error to the user-space send/sendto/sendmsg syscall instead of crashing the kernel. This fix prevents exploitation by enforcing socket type checks before performing the redirect. The vulnerability does not appear to have known exploits in the wild yet, but it can cause denial of service (DoS) by crashing the kernel if triggered. The issue affects Linux kernel versions that include the problematic commit and is relevant to systems using BPF sockmap/sk_msg features for advanced socket message steering.

For European organizations, this vulnerability primarily presents a risk of denial of service (DoS) on Linux systems that utilize BPF sockmap/sk_msg features for network packet processing or socket message redirection. Such systems are often found in high-performance networking environments, including telecom infrastructure, cloud data centers, and advanced network appliances. A kernel crash caused by this vulnerability could disrupt critical services, leading to downtime and potential loss of availability. While the vulnerability does not directly expose confidentiality or integrity risks, the resulting system instability could impact service continuity and operational reliability. Organizations relying on Linux-based network functions virtualization (NFV), container orchestration platforms (e.g., Kubernetes nodes running Linux kernels with BPF features), or custom network monitoring and filtering solutions may be particularly affected. The lack of known exploits reduces immediate risk, but the potential for accidental or malicious triggering of the crash remains. This could be leveraged by attackers to cause service interruptions or to distract from other attack activities. Given the widespread use of Linux in European enterprise and public sector infrastructure, the impact could be significant if unpatched systems are exposed in critical network roles.

1. Apply the official Linux kernel patches that reject sk_msg egress redirects to non-TCP sockets as soon as they become available for your distribution or kernel version. This is the definitive fix preventing the crash. 2. Audit and review any custom BPF programs or applications that use sockmap/sk_msg features to ensure they do not attempt to redirect messages to non-TCP sockets. 3. Implement kernel crash monitoring and alerting to detect and respond quickly to any unexpected kernel panics or oops events related to networking. 4. Restrict access to BPF program loading and socket map manipulation to trusted users and processes only, minimizing the risk of accidental or malicious triggering. 5. For environments using container orchestration or NFV, ensure that node kernels are updated promptly and that network functions are tested for compatibility with the patched kernel. 6. Consider deploying runtime security tools that monitor kernel behavior and can block or alert on suspicious BPF activity. 7. Maintain a robust incident response plan to handle potential DoS events caused by kernel crashes, including failover and redundancy strategies.