CVE-2023-52636 (GCVE-0-2023-52636)
Vulnerability from cvelistv5
Published
2024-04-02 07:01
Modified
2026-08-05 09:10
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for more data to be available on the socket A short read may occur while reading the message footer from the socket. Later, when the socket is ready for another read, the messenger invokes all read_partial_*() handlers, including read_partial_sparse_msg_data(). The expectation is that read_partial_sparse_msg_data() would bail, allowing the messenger to invoke read_partial() for the footer and pick up where it left off. However read_partial_sparse_msg_data() violates that and ends up calling into the state machine in the OSD client. The sparse-read state machine assumes that it's a new op and interprets some piece of the footer as the sparse-read header and returns bogus extents/data length, etc. To determine whether read_partial_sparse_msg_data() should bail, let's reuse cursor->total_resid. Because once it reaches to zero that means all the extents and data have been successfully received in last read, else it could break out when partially reading any of the extents and data. And then osd_sparse_read() could continue where it left off. [ idryomov: changelog ]
References
Impacted products
Vendor Product Version
Linux Linux Version: d396f89db39a2f259e2125ca43b4c31bb65afcad
Version: d396f89db39a2f259e2125ca43b4c31bb65afcad
Version: d396f89db39a2f259e2125ca43b4c31bb65afcad
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:21.209Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52636",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:53:29.480667Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:37.157Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/ceph/messenger.h",
            "net/ceph/messenger_v1.c",
            "net/ceph/messenger_v2.c",
            "net/ceph/osd_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "da9c33a70f095d5d55c36d0bfeba969e31de08ae",
              "status": "affected",
              "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad",
              "versionType": "git"
            },
            {
              "lessThan": "bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8",
              "status": "affected",
              "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad",
              "versionType": "git"
            },
            {
              "lessThan": "8e46a2d068c92a905d01cbb018b00d66991585ab",
              "status": "affected",
              "version": "d396f89db39a2f259e2125ca43b4c31bb65afcad",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/ceph/messenger.h",
            "net/ceph/messenger_v1.c",
            "net/ceph/messenger_v2.c",
            "net/ceph/osd_client.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.17",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.5",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlibceph: just wait for more data to be available on the socket\n\nA short read may occur while reading the message footer from the\nsocket.  Later, when the socket is ready for another read, the\nmessenger invokes all read_partial_*() handlers, including\nread_partial_sparse_msg_data().  The expectation is that\nread_partial_sparse_msg_data() would bail, allowing the messenger to\ninvoke read_partial() for the footer and pick up where it left off.\n\nHowever read_partial_sparse_msg_data() violates that and ends up\ncalling into the state machine in the OSD client.  The sparse-read\nstate machine assumes that it\u0027s a new op and interprets some piece of\nthe footer as the sparse-read header and returns bogus extents/data\nlength, etc.\n\nTo determine whether read_partial_sparse_msg_data() should bail, let\u0027s\nreuse cursor-\u003etotal_resid.  Because once it reaches to zero that means\nall the extents and data have been successfully received in last read,\nelse it could break out when partially reading any of the extents and\ndata.  And then osd_sparse_read() could continue where it left off.\n\n[ idryomov: changelog ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is in libceph\u0027s msgr1 TCP receive handler processing sparse-read replies from a remote Ceph OSD peer; a malicious or compromised OSD can deliver the triggering message over the network.\nAC:L - An attacking OSD fully controls response content and TCP segmentation, so it can reliably force a short read exactly after sparse payload completion and supply footer bytes that the state machine misinterprets.\nPR:N - Exploitation requires no privileges on the victim host; the attacker acts as a remote OSD peer already speaking the Ceph protocol to the client, analogous to other malicious-server client parser bugs.\nUI:N - Once CephFS is mounted with sparse reads in use (encrypted inodes or sparseread), ordinary client I/O drives the vulnerable receive path without further user action.\nS:U - Impact is confined to the local kernel Ceph client; there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:N - The bug misparses on-wire footer/extent metadata and may overwrite the intended read buffer or fault the connection, but it does not disclose kernel memory or provide an arbitrary read primitive.\nI:L - Re-entering the sparse-read machine can re-initialize the cursor and write misparsed footer/stream bytes into the in-progress page-cache read buffer, corrupting that data in a limited, buffer-bounded way rather than enabling arbitrary kernel writes.\nA:H - Misparsed extent counts drive huge allocations (observed ~2.2B extents), connection faults, allocator WARNs, and cursor overruns that hit BUG_ON, denying Ceph I/O and potentially crashing the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:10:48.688Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab"
        }
      ],
      "title": "libceph: just wait for more data to be available on the socket",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52636",
    "datePublished": "2024-04-02T07:01:38.187Z",
    "dateReserved": "2024-03-06T09:52:12.093Z",
    "dateUpdated": "2026-08-05T09:10:48.688Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:03:21.209Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52636\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:53:29.480667Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:17.655Z\"}}], \"cna\": {\"title\": \"libceph: just wait for more data to be available on the socket\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.2, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable path is in libceph\u0027s msgr1 TCP receive handler processing sparse-read replies from a remote Ceph OSD peer; a malicious or compromised OSD can deliver the triggering message over the network.\\nAC:L - An attacking OSD fully controls response content and TCP segmentation, so it can reliably force a short read exactly after sparse payload completion and supply footer bytes that the state machine misinterprets.\\nPR:N - Exploitation requires no privileges on the victim host; the attacker acts as a remote OSD peer already speaking the Ceph protocol to the client, analogous to other malicious-server client parser bugs.\\nUI:N - Once CephFS is mounted with sparse reads in use (encrypted inodes or sparseread), ordinary client I/O drives the vulnerable receive path without further user action.\\nS:U - Impact is confined to the local kernel Ceph client; there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\\nC:N - The bug misparses on-wire footer/extent metadata and may overwrite the intended read buffer or fault the connection, but it does not disclose kernel memory or provide an arbitrary read primitive.\\nI:L - Re-entering the sparse-read machine can re-initialize the cursor and write misparsed footer/stream bytes into the in-progress page-cache read buffer, corrupting that data in a limited, buffer-bounded way rather than enabling arbitrary kernel writes.\\nA:H - Misparsed extent counts drive huge allocations (observed ~2.2B extents), connection faults, allocator WARNs, and cursor overruns that hit BUG_ON, denying Ceph I/O and potentially crashing the kernel.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d396f89db39a2f259e2125ca43b4c31bb65afcad\", \"lessThan\": \"da9c33a70f095d5d55c36d0bfeba969e31de08ae\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d396f89db39a2f259e2125ca43b4c31bb65afcad\", \"lessThan\": \"bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d396f89db39a2f259e2125ca43b4c31bb65afcad\", \"lessThan\": \"8e46a2d068c92a905d01cbb018b00d66991585ab\", \"versionType\": \"git\"}], \"programFiles\": [\"include/linux/ceph/messenger.h\", \"net/ceph/messenger_v1.c\", \"net/ceph/messenger_v2.c\", \"net/ceph/osd_client.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.17\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"include/linux/ceph/messenger.h\", \"net/ceph/messenger_v1.c\", \"net/ceph/messenger_v2.c\", \"net/ceph/osd_client.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/da9c33a70f095d5d55c36d0bfeba969e31de08ae\"}, {\"url\": \"https://git.kernel.org/stable/c/bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8\"}, {\"url\": \"https://git.kernel.org/stable/c/8e46a2d068c92a905d01cbb018b00d66991585ab\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nlibceph: just wait for more data to be available on the socket\\n\\nA short read may occur while reading the message footer from the\\nsocket.  Later, when the socket is ready for another read, the\\nmessenger invokes all read_partial_*() handlers, including\\nread_partial_sparse_msg_data().  The expectation is that\\nread_partial_sparse_msg_data() would bail, allowing the messenger to\\ninvoke read_partial() for the footer and pick up where it left off.\\n\\nHowever read_partial_sparse_msg_data() violates that and ends up\\ncalling into the state machine in the OSD client.  The sparse-read\\nstate machine assumes that it\u0027s a new op and interprets some piece of\\nthe footer as the sparse-read header and returns bogus extents/data\\nlength, etc.\\n\\nTo determine whether read_partial_sparse_msg_data() should bail, let\u0027s\\nreuse cursor-\u003etotal_resid.  Because once it reaches to zero that means\\nall the extents and data have been successfully received in last read,\\nelse it could break out when partially reading any of the extents and\\ndata.  And then osd_sparse_read() could continue where it left off.\\n\\n[ idryomov: changelog ]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.17\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.5\", \"versionStartIncluding\": \"6.6\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"6.6\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:10:48.688Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52636\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:10:48.688Z\", \"dateReserved\": \"2024-03-06T09:52:12.093Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-02T07:01:38.187Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.