CVE-2023-53072 (GCVE-0-2023-53072)
Vulnerability from cvelistv5
Published
2025-05-02 15:55
Modified
2026-08-05 09:12
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: use the workqueue to destroy unaccepted sockets Christoph reported a UaF at token lookup time after having refactored the passive socket initialization part: BUG: KASAN: use-after-free in __token_bucket_busy+0x253/0x260 Read of size 4 at addr ffff88810698d5b0 by task syz-executor653/3198 CPU: 1 PID: 3198 Comm: syz-executor653 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x6e/0x91 print_report+0x16a/0x46f kasan_report+0xad/0x130 __token_bucket_busy+0x253/0x260 mptcp_token_new_connect+0x13d/0x490 mptcp_connect+0x4ed/0x860 __inet_stream_connect+0x80e/0xd90 tcp_sendmsg_fastopen+0x3ce/0x710 mptcp_sendmsg+0xff1/0x1a20 inet_sendmsg+0x11d/0x140 __sys_sendto+0x405/0x490 __x64_sys_sendto+0xdc/0x1b0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc We need to properly clean-up all the paired MPTCP-level resources and be sure to release the msk last, even when the unaccepted subflow is destroyed by the TCP internals via inet_child_forget(). We can re-use the existing MPTCP_WORK_CLOSE_SUBFLOW infra, explicitly checking that for the critical scenario: the closed subflow is the MPC one, the msk is not accepted and eventually going through full cleanup. With such change, __mptcp_destroy_sock() is always called on msk sockets, even on accepted ones. We don't need anymore to transiently drop one sk reference at msk clone time. Please note this commit depends on the parent one: mptcp: refactor passive socket initialization
References
Impacted products
Vendor Product Version
Linux Linux Version: 58b09919626bf9067345289212ec030c61eb1034
Version: 58b09919626bf9067345289212ec030c61eb1034
Version: 58b09919626bf9067345289212ec030c61eb1034
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c",
            "net/mptcp/protocol.h",
            "net/mptcp/subflow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2827f099b3fb9a59263c997400e9182f5d423e84",
              "status": "affected",
              "version": "58b09919626bf9067345289212ec030c61eb1034",
              "versionType": "git"
            },
            {
              "lessThan": "804cf487fb0031f3c74755b78d8663333f0ba636",
              "status": "affected",
              "version": "58b09919626bf9067345289212ec030c61eb1034",
              "versionType": "git"
            },
            {
              "lessThan": "b6985b9b82954caa53f862d6059d06c0526254f0",
              "status": "affected",
              "version": "58b09919626bf9067345289212ec030c61eb1034",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/protocol.c",
            "net/mptcp/protocol.h",
            "net/mptcp/subflow.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.22",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.8",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: use the workqueue to destroy unaccepted sockets\n\nChristoph reported a UaF at token lookup time after having\nrefactored the passive socket initialization part:\n\n  BUG: KASAN: use-after-free in __token_bucket_busy+0x253/0x260\n  Read of size 4 at addr ffff88810698d5b0 by task syz-executor653/3198\n\n  CPU: 1 PID: 3198 Comm: syz-executor653 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x6e/0x91\n   print_report+0x16a/0x46f\n   kasan_report+0xad/0x130\n   __token_bucket_busy+0x253/0x260\n   mptcp_token_new_connect+0x13d/0x490\n   mptcp_connect+0x4ed/0x860\n   __inet_stream_connect+0x80e/0xd90\n   tcp_sendmsg_fastopen+0x3ce/0x710\n   mptcp_sendmsg+0xff1/0x1a20\n   inet_sendmsg+0x11d/0x140\n   __sys_sendto+0x405/0x490\n   __x64_sys_sendto+0xdc/0x1b0\n   do_syscall_64+0x3b/0x90\n   entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nWe need to properly clean-up all the paired MPTCP-level\nresources and be sure to release the msk last, even when\nthe unaccepted subflow is destroyed by the TCP internals\nvia inet_child_forget().\n\nWe can re-use the existing MPTCP_WORK_CLOSE_SUBFLOW infra,\nexplicitly checking that for the critical scenario: the\nclosed subflow is the MPC one, the msk is not accepted and\neventually going through full cleanup.\n\nWith such change, __mptcp_destroy_sock() is always called\non msk sockets, even on accepted ones. We don\u0027t need anymore\nto transiently drop one sk reference at msk clone time.\n\nPlease note this commit depends on the parent one:\n\n  mptcp: refactor passive socket initialization"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The reliable trigger is an unprivileged local process creating an IPPROTO_MPTCP listener and connecting to it (syzkaller socket/bind/listen/sendto TFO reproducer); inet_child_forget() only frees the unaccepted msk when the listener is not in TCP_LISTEN, which the attacker drives via their own sockets rather than unsolicited remote packets alone.\nAC:L - The attacker fully controls both the listener and the connecting peer and can force inet_child_forget() to drop the sole msk reference without mptcp_token_destroy(), leaving the freed sock in the token hash; syzkaller reproduced this reliably with no dependency on external timing or layout.\nPR:L - Creating, binding, and listening on IPPROTO_MPTCP sockets needs only an unprivileged local account (net.mptcp.enabled defaults to 1; mptcp_init_sock has no CAP_* gate), including inside user/net namespaces.\nUI:N - Exploitation uses only the attacker\u0027s own MPTCP sockets and connect/close syscalls; no separate victim action is required.\nS:U - This is a same-host kernel slab UAF/privilege-escalation class bug; impact stays within the kernel\u0027s security authority with no VM, IOMMU, or sandbox boundary crossed.\nC:H - The UAF leaves a freed kmalloc-2k mptcp/struct sock linked in the global token hash, so later __token_lookup_msk/mptcp_token_get_sock walks attacker-reclaimable memory and can disclose arbitrary kernel data.\nI:H - Reclaiming the freed sock in the token hash enables fake-object injection and subsequent MPTCP paths (including refcount updates via mptcp_token_get_sock) to act on attacker-controlled memory for arbitrary write and control-flow hijack.\nA:H - The UAF already produces a KASAN use-after-free oops in __token_bucket_busy and can soft-lockup in mptcp_token_exists on a corrupted hash chain, crashing or hanging the kernel even without further exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:12:36.982Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2827f099b3fb9a59263c997400e9182f5d423e84"
        },
        {
          "url": "https://git.kernel.org/stable/c/804cf487fb0031f3c74755b78d8663333f0ba636"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6985b9b82954caa53f862d6059d06c0526254f0"
        }
      ],
      "title": "mptcp: use the workqueue to destroy unaccepted sockets",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53072",
    "datePublished": "2025-05-02T15:55:23.765Z",
    "dateReserved": "2025-05-02T15:51:43.548Z",
    "dateUpdated": "2026-08-05T09:12:36.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.