CVE-2023-52885

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svc_tcp_listen_data_ready() After the listener svc_sock is freed, and before invoking svc_tcp_accept() for the established child sock, there is a window that the newsock retaining a freed listener svc_sock in sk_user_data which cloning from parent. In the race window, if data is received on the newsock, we will observe use-after-free report in svc_tcp_listen_data_ready(). Reproduce by two tasks: 1. while :; do rpc.nfsd 0 ; rpc.nfsd; done 2. while :; do echo "" | ncat -4 127.0.0.1 2049 ; done KASAN report:...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= fa9251afc33c81606d70cfe91800a779096442ec < c7b8c2d06e437639694abe76978e915cfb73f428, >= fa9251afc33c81606d70cfe91800a779096442ec < dfc896c4a75cb8cd7cb2dfd9b469cf1e3f004254, >= fa9251afc33c81606d70cfe91800a779096442ec < 42725e5c1b181b757ba11d804443922982334d9b, >= fa9251afc33c81606d70cfe91800a779096442ec < cd5ec3ee52ce4b7e283cc11facfa420c297c8065, >= fa9251afc33c81606d70cfe91800a779096442ec < fbf4ace39b2e4f3833236afbb2336edbafd75eee, >= fa9251afc33c81606d70cfe91800a779096442ec < ef047411887ff0845afd642d6a687819308e1a4e, >= fa9251afc33c81606d70cfe91800a779096442ec < 7e1f989055622fd086c5dfb291fc72adf5660b6f, >= fa9251afc33c81606d70cfe91800a779096442ec < fc80fc2d4e39137869da3150ee169b40bf879287, >= 4.8, >= 4.8 < 4.14.322, >= 4.15 < 4.19.291, >= 4.20 < 5.4.251, >= 5.5 < 5.10.188, >= 5.11 < 5.15.121, >= 5.16 < 6.1.39, >= 6.2 < 6.4.4

Fixed versions

4.14.322, 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.39, 6.4.4

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416