CVE-2023-53867 (GCVE-0-2023-53867)
Vulnerability from cvelistv5
Published
2025-12-24 10:55
Modified
2026-08-05 09:16
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: fix potential use-after-free bug when trimming caps When trimming the caps and just after the 'session->s_cap_lock' is released in ceph_iterate_session_caps() the cap maybe removed by another thread, and when using the stale cap memory in the callbacks it will trigger use-after-free crash. We need to check the existence of the cap just after the 'ci->i_ceph_lock' being acquired. And do nothing if it's already removed.
References
Impacted products
Vendor Product Version
Linux Linux Version: 2f2dc053404febedc9c273452d9d518fb31fde72
Version: 2f2dc053404febedc9c273452d9d518fb31fde72
Version: 2f2dc053404febedc9c273452d9d518fb31fde72
Version: 2f2dc053404febedc9c273452d9d518fb31fde72
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/caps.c",
            "fs/ceph/debugfs.c",
            "fs/ceph/mds_client.c",
            "fs/ceph/mds_client.h",
            "fs/ceph/super.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2b2515b8095cf2149bef44383a99d5b5677f1831",
              "status": "affected",
              "version": "2f2dc053404febedc9c273452d9d518fb31fde72",
              "versionType": "git"
            },
            {
              "lessThan": "448875a73e16ba7d81dec9274ce9d33a12d092fb",
              "status": "affected",
              "version": "2f2dc053404febedc9c273452d9d518fb31fde72",
              "versionType": "git"
            },
            {
              "lessThan": "ae6e935618d99cdba11eab4714092e7e5f13cf7e",
              "status": "affected",
              "version": "2f2dc053404febedc9c273452d9d518fb31fde72",
              "versionType": "git"
            },
            {
              "lessThan": "aaf67de78807c59c35bafb5003d4fb457c764800",
              "status": "affected",
              "version": "2f2dc053404febedc9c273452d9d518fb31fde72",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ceph/caps.c",
            "fs/ceph/debugfs.c",
            "fs/ceph/mds_client.c",
            "fs/ceph/mds_client.h",
            "fs/ceph/super.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.34"
            },
            {
              "lessThan": "2.6.34",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.28",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.15",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.2",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "2.6.34",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nceph: fix potential use-after-free bug when trimming caps\n\nWhen trimming the caps and just after the \u0027session-\u003es_cap_lock\u0027 is\nreleased in ceph_iterate_session_caps() the cap maybe removed by\nanother thread, and when using the stale cap memory in the callbacks\nit will trigger use-after-free crash.\n\nWe need to check the existence of the cap just after the \u0027ci-\u003ei_ceph_lock\u0027\nbeing acquired. And do nothing if it\u0027s already removed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Every caller of the vulnerable `ceph_iterate_session_caps()` is driven by a message received from the remote Ceph MDS over TCP \u2014 `CEPH_SESSION_RECALL_STATE` (trim), `CLOSE`/`REJECT` (remove_session_caps), `STALE` (renewcaps) and MDS reconnect \u2014 processed in `handle_session()` on the messenger workqueue. A malicious, compromised, or on-path-spoofed MDS reaches the code purely with network traffic.\nAC:L - The attacker drives both sides of the race: `RECALL_STATE`/session-close/reconnect storms start the cap iteration while concurrent cap-revoke/export/session messages and the callback\u0027s own `d_prune_aliases()`/inode-eviction path remove caps. The window spans sleeping operations (`d_find_primary()`, `ceph_mdsc_build_path()`, dentry pruning) and can be retried indefinitely, so it is reliably hit.\nPR:N - No credentials or privileges on the victim client are required \u2014 the malicious MDS peer needs no local authority, and the code runs unauthenticated with respect to the client\u0027s privilege model. Locally, mere unprivileged access to a mounted CephFS is enough to generate the concurrent cap churn.\nUI:N - Exploitation needs no victim action beyond an already-mounted CephFS, which is the normal operating state of an affected system; the MDS drives the whole sequence on its own.\nS:U - The stale `struct ceph_cap` corruption and the resulting oops are confined to the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The use-after-free gives a read primitive over freed/recycled `ceph_cap` slab memory, and `reconnect_caps_cb()` encodes those stale fields (`cap-\u003ecap_id`, `cap-\u003eissued`) directly into the reconnect message transmitted to the MDS, exfiltrating freed-object contents to the attacker.\nI:H - The callbacks write into the stale object \u2014 `cap-\u003eseq/issue_seq/mseq/cap_gen = 0` in `reconnect_caps_cb()` and `cap-\u003eissued = cap-\u003eimplemented = CEPH_CAP_PIN` in `wake_up_session_cb()` \u2014 corrupting a recycled `ceph_cap` (and thus another inode\u0027s capability/coherency state), a UAF write primitive usable for heap grooming toward control-flow hijack.\nA:H - The reported real-world outcome is a kernel NULL-pointer dereference oops in `__ceph_remove_cap()` from the trim-caps path (Ceph tracker #43272), and any use-after-free of the cap object crashes the client; the MDS can trigger it repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:16:28.667Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2b2515b8095cf2149bef44383a99d5b5677f1831"
        },
        {
          "url": "https://git.kernel.org/stable/c/448875a73e16ba7d81dec9274ce9d33a12d092fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae6e935618d99cdba11eab4714092e7e5f13cf7e"
        },
        {
          "url": "https://git.kernel.org/stable/c/aaf67de78807c59c35bafb5003d4fb457c764800"
        }
      ],
      "title": "ceph: fix potential use-after-free bug when trimming caps",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53867",
    "datePublished": "2025-12-24T10:55:25.430Z",
    "dateReserved": "2025-12-09T01:27:17.829Z",
    "dateUpdated": "2026-08-05T09:16:28.667Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.