CVE-2023-53088 (GCVE-0-2023-53088)
Vulnerability from cvelistv5
Published
2025-05-02 15:55
Modified
2026-10-15 21:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix UaF in listener shutdown
As reported by Christoph after having refactored the passive
socket initialization, the mptcp listener shutdown path is prone
to an UaF issue.
BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x73/0xe0
Write of size 4 at addr ffff88810cb23098 by task syz-executor731/1266
CPU: 1 PID: 1266 Comm: syz-executor731 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x6e/0x91
print_report+0x16a/0x46f
kasan_report+0xad/0x130
kasan_check_range+0x14a/0x1a0
_raw_spin_lock_bh+0x73/0xe0
subflow_error_report+0x6d/0x110
sk_error_report+0x3b/0x190
tcp_disconnect+0x138c/0x1aa0
inet_child_forget+0x6f/0x2e0
inet_csk_listen_stop+0x209/0x1060
__mptcp_close_ssk+0x52d/0x610
mptcp_destroy_common+0x165/0x640
mptcp_destroy+0x13/0x80
__mptcp_destroy_sock+0xe7/0x270
__mptcp_close+0x70e/0x9b0
mptcp_close+0x2b/0x150
inet_release+0xe9/0x1f0
__sock_release+0xd2/0x280
sock_close+0x15/0x20
__fput+0x252/0xa20
task_work_run+0x169/0x250
exit_to_user_mode_prepare+0x113/0x120
syscall_exit_to_user_mode+0x1d/0x40
do_syscall_64+0x48/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
The msk grace period can legitly expire in between the last
reference count dropped in mptcp_subflow_queue_clean() and
the later eventual access in inet_csk_listen_stop()
After the previous patch we don't need anymore special-casing
msk listener socket cleanup: the mptcp worker will process each
of the unaccepted msk sockets.
Just drop the now unnecessary code.
Please note this commit depends on the two parent ones:
mptcp: refactor passive socket initialization
mptcp: use the workqueue to destroy unaccepted sockets
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-53088",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T21:33:38.582433Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T21:41:26.237Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mptcp/protocol.c",
"net/mptcp/protocol.h",
"net/mptcp/subflow.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5564be74a22a61855f8b8c100d8c4abb003bb792",
"status": "affected",
"version": "6aeed9045071f2252ff4e98fc13d1e304f33e5b0",
"versionType": "git"
},
{
"lessThan": "0f4f4cf5d32f10543deb946a37111e714579511e",
"status": "affected",
"version": "6aeed9045071f2252ff4e98fc13d1e304f33e5b0",
"versionType": "git"
},
{
"lessThan": "0a3f4f1f9c27215e4ddcd312558342e57b93e518",
"status": "affected",
"version": "6aeed9045071f2252ff4e98fc13d1e304f33e5b0",
"versionType": "git"
},
{
"status": "affected",
"version": "a8a3e95c74e48c2c9b07b81fafda9122993f2e12",
"versionType": "git"
},
{
"lessThan": "5.19",
"status": "affected",
"version": "5.18.10",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mptcp/protocol.c",
"net/mptcp/protocol.h",
"net/mptcp/subflow.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.22",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.8",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix UaF in listener shutdown\n\nAs reported by Christoph after having refactored the passive\nsocket initialization, the mptcp listener shutdown path is prone\nto an UaF issue.\n\n BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x73/0xe0\n Write of size 4 at addr ffff88810cb23098 by task syz-executor731/1266\n\n CPU: 1 PID: 1266 Comm: syz-executor731 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x6e/0x91\n print_report+0x16a/0x46f\n kasan_report+0xad/0x130\n kasan_check_range+0x14a/0x1a0\n _raw_spin_lock_bh+0x73/0xe0\n subflow_error_report+0x6d/0x110\n sk_error_report+0x3b/0x190\n tcp_disconnect+0x138c/0x1aa0\n inet_child_forget+0x6f/0x2e0\n inet_csk_listen_stop+0x209/0x1060\n __mptcp_close_ssk+0x52d/0x610\n mptcp_destroy_common+0x165/0x640\n mptcp_destroy+0x13/0x80\n __mptcp_destroy_sock+0xe7/0x270\n __mptcp_close+0x70e/0x9b0\n mptcp_close+0x2b/0x150\n inet_release+0xe9/0x1f0\n __sock_release+0xd2/0x280\n sock_close+0x15/0x20\n __fput+0x252/0xa20\n task_work_run+0x169/0x250\n exit_to_user_mode_prepare+0x113/0x120\n syscall_exit_to_user_mode+0x1d/0x40\n do_syscall_64+0x48/0x90\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nThe msk grace period can legitly expire in between the last\nreference count dropped in mptcp_subflow_queue_clean() and\nthe later eventual access in inet_csk_listen_stop()\n\nAfter the previous patch we don\u0027t need anymore special-casing\nmsk listener socket cleanup: the mptcp worker will process each\nof the unaccepted msk sockets.\n\nJust drop the now unnecessary code.\n\nPlease note this commit depends on the two parent ones:\n\n mptcp: refactor passive socket initialization\n mptcp: use the workqueue to destroy unaccepted sockets"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is triggered by closing a local MPTCP listening socket that still has unaccepted connections; the entry path is socket/bind/listen/connect/close syscalls, not remote packet processing alone.\nAC:L - The attacker fully controls both the listener and the connecting peer and can force the close path that frees the msk then reuses it; the RCU window is schedulable (mutex between sock_put and inet_csk_listen_stop) and was reliably hit by syzkaller reproducers.\nPR:L - Creating and listening on IPPROTO_MPTCP sockets requires only an unprivileged local account (mptcp enabled by default; no CAP_* on the trigger path), including inside user/net namespaces.\nUI:N - Exploitation uses only the attacker\u0027s own sockets and close(); no victim action is required.\nS:U - This is a same-host kernel memory-corruption privilege-escalation class bug; impact stays within the kernel\u0027s security authority with no VM/IOMMU boundary crossed.\nC:H - The UAF targets a full mptcp/struct sock object in kmalloc-2k; after RCU free the attacker can reclaim and read through the dangling subflow-\u003econn reference.\nI:H - Reclaiming the freed sock enables controlled writes and control-flow hijack via the subsequent subflow_error_report/mptcp_data_lock path on attacker-influenced memory.\nA:H - The UAF already produces a KASAN-detectable kernel write-after-free/oops on the spinlock path, so availability impact is a full kernel crash even without further exploitation."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T09:12:43.438Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5564be74a22a61855f8b8c100d8c4abb003bb792"
},
{
"url": "https://git.kernel.org/stable/c/0f4f4cf5d32f10543deb946a37111e714579511e"
},
{
"url": "https://git.kernel.org/stable/c/0a3f4f1f9c27215e4ddcd312558342e57b93e518"
}
],
"title": "mptcp: fix UaF in listener shutdown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53088",
"datePublished": "2025-05-02T15:55:34.840Z",
"dateReserved": "2025-05-02T15:51:43.551Z",
"dateUpdated": "2026-10-15T21:41:26.237Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-53088\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-15T21:33:38.582433Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-15T21:33:39.423Z\"}}], \"cna\": {\"title\": \"mptcp: fix UaF in listener shutdown\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is triggered by closing a local MPTCP listening socket that still has unaccepted connections; the entry path is socket/bind/listen/connect/close syscalls, not remote packet processing alone.\\nAC:L - The attacker fully controls both the listener and the connecting peer and can force the close path that frees the msk then reuses it; the RCU window is schedulable (mutex between sock_put and inet_csk_listen_stop) and was reliably hit by syzkaller reproducers.\\nPR:L - Creating and listening on IPPROTO_MPTCP sockets requires only an unprivileged local account (mptcp enabled by default; no CAP_* on the trigger path), including inside user/net namespaces.\\nUI:N - Exploitation uses only the attacker\u0027s own sockets and close(); no victim action is required.\\nS:U - This is a same-host kernel memory-corruption privilege-escalation class bug; impact stays within the kernel\u0027s security authority with no VM/IOMMU boundary crossed.\\nC:H - The UAF targets a full mptcp/struct sock object in kmalloc-2k; after RCU free the attacker can reclaim and read through the dangling subflow-\u003econn reference.\\nI:H - Reclaiming the freed sock enables controlled writes and control-flow hijack via the subsequent subflow_error_report/mptcp_data_lock path on attacker-influenced memory.\\nA:H - The UAF already produces a KASAN-detectable kernel write-after-free/oops on the spinlock path, so availability impact is a full kernel crash even without further exploitation.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6aeed9045071f2252ff4e98fc13d1e304f33e5b0\", \"lessThan\": \"5564be74a22a61855f8b8c100d8c4abb003bb792\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6aeed9045071f2252ff4e98fc13d1e304f33e5b0\", \"lessThan\": \"0f4f4cf5d32f10543deb946a37111e714579511e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"6aeed9045071f2252ff4e98fc13d1e304f33e5b0\", \"lessThan\": \"0a3f4f1f9c27215e4ddcd312558342e57b93e518\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a8a3e95c74e48c2c9b07b81fafda9122993f2e12\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.18.10\", \"lessThan\": \"5.19\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/mptcp/protocol.c\", \"net/mptcp/protocol.h\", \"net/mptcp/subflow.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.19\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.19\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.22\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.2.*\"}, {\"status\": \"unaffected\", \"version\": \"6.3\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/mptcp/protocol.c\", \"net/mptcp/protocol.h\", \"net/mptcp/subflow.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/5564be74a22a61855f8b8c100d8c4abb003bb792\"}, {\"url\": \"https://git.kernel.org/stable/c/0f4f4cf5d32f10543deb946a37111e714579511e\"}, {\"url\": \"https://git.kernel.org/stable/c/0a3f4f1f9c27215e4ddcd312558342e57b93e518\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: fix UaF in listener shutdown\\n\\nAs reported by Christoph after having refactored the passive\\nsocket initialization, the mptcp listener shutdown path is prone\\nto an UaF issue.\\n\\n BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x73/0xe0\\n Write of size 4 at addr ffff88810cb23098 by task syz-executor731/1266\\n\\n CPU: 1 PID: 1266 Comm: syz-executor731 Not tainted 6.2.0-rc59af4eaa31c1f6c00c8f1e448ed99a45c66340dd5 #6\\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\\n Call Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x6e/0x91\\n print_report+0x16a/0x46f\\n kasan_report+0xad/0x130\\n kasan_check_range+0x14a/0x1a0\\n _raw_spin_lock_bh+0x73/0xe0\\n subflow_error_report+0x6d/0x110\\n sk_error_report+0x3b/0x190\\n tcp_disconnect+0x138c/0x1aa0\\n inet_child_forget+0x6f/0x2e0\\n inet_csk_listen_stop+0x209/0x1060\\n __mptcp_close_ssk+0x52d/0x610\\n mptcp_destroy_common+0x165/0x640\\n mptcp_destroy+0x13/0x80\\n __mptcp_destroy_sock+0xe7/0x270\\n __mptcp_close+0x70e/0x9b0\\n mptcp_close+0x2b/0x150\\n inet_release+0xe9/0x1f0\\n __sock_release+0xd2/0x280\\n sock_close+0x15/0x20\\n __fput+0x252/0xa20\\n task_work_run+0x169/0x250\\n exit_to_user_mode_prepare+0x113/0x120\\n syscall_exit_to_user_mode+0x1d/0x40\\n do_syscall_64+0x48/0x90\\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\\n\\nThe msk grace period can legitly expire in between the last\\nreference count dropped in mptcp_subflow_queue_clean() and\\nthe later eventual access in inet_csk_listen_stop()\\n\\nAfter the previous patch we don\u0027t need anymore special-casing\\nmsk listener socket cleanup: the mptcp worker will process each\\nof the unaccepted msk sockets.\\n\\nJust drop the now unnecessary code.\\n\\nPlease note this commit depends on the two parent ones:\\n\\n mptcp: refactor passive socket initialization\\n mptcp: use the workqueue to destroy unaccepted sockets\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.22\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2.8\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.3\", \"versionStartIncluding\": \"5.19\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.18.10\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:12:43.438Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2023-53088\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-15T21:41:26.237Z\", \"dateReserved\": \"2025-05-02T15:51:43.551Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-05-02T15:55:34.840Z\", \"assignerShortName\": \"Linux\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…