by Kastro
Paper/Archive/CVE-2023-53867

CVE-2023-53867

Linux Linux — ceph: fix potential use-after-free bug when trimming caps

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 44.9.449 × 209.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

In the Linux kernel, the following vulnerability has been resolved: ceph: fix potential use-after-free bug when trimming caps When trimming the caps and just after the 'session->s_cap_lock' is released in ceph_iterate_session_caps() the cap maybe removed by another thread, and when using the stale cap memory in the callbacks it will trigger use-after-free crash. We need to check the existence of the cap just after the 'ci->i_ceph_lock' being acquired. And do nothing if it's already removed.

Affected

ProductAffectedFixed inSource
Linux2f2dc053404febedc9c273452d9d518fb31fde72 – < 2b2515b8095cf2149bef44383a99d5b5677f18312b2515b8095cf2149bef44383a99d5b5677f1831CNA
Linux2f2dc053404febedc9c273452d9d518fb31fde72 – < 448875a73e16ba7d81dec9274ce9d33a12d092fb448875a73e16ba7d81dec9274ce9d33a12d092fbCNA
Linux2f2dc053404febedc9c273452d9d518fb31fde72 – < ae6e935618d99cdba11eab4714092e7e5f13cf7eae6e935618d99cdba11eab4714092e7e5f13cf7eCNA
Linux2f2dc053404febedc9c273452d9d518fb31fde72 – < aaf67de78807c59c35bafb5003d4fb457c764800aaf67de78807c59c35bafb5003d4fb457c764800CNA
Linux2.6.34–CNA

Scores by source

Linux (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgit.kernel.org/stable/c/2b2515b8095cf2149bef44383a99d5b5677f1831refgit.kernel.org/stable/c/448875a73e16ba7d81dec9274ce9d33a12d092fbrefgit.kernel.org/stable/c/ae6e935618d99cdba11eab4714092e7e5f13cf7erefgit.kernel.org/stable/c/aaf67de78807c59c35bafb5003d4fb457c764800